MICROSOFT has released a Patch Tuesday update to fix CVE-2026-103572, a remote code execution flaw said to affect Visual Studio Copilot and SQL Server Management Studio (SSMS). The vulnerability stems from a shared library, Microsoft.VisualStudio.Copilot.Core[.]dll, and can be triggered by indirect prompt injection when the AI assistant processes untrusted files or external data.
Public proof-of-concept demonstrations have appeared online, but Microsoft notes no confirmed exploitation in the wild at the time of the advisory. The CVSS score is 8.8 (High, CVSSv3). The affected products include Visual Studio 2026 with GitHub Copilot integration, Visual Studio 2022 (and Visual Studio Tools for Applications), and SSMS versions that support Copilot and MCP (Model Context Protocol) servers.
Technical details outlined by researcher Johann Rehberger describe a trailing-dot path validation bypass. Windows file APIs ignore trailing periods in file names during write operations, allowing an input with a trailing dot to bypass protection checks and then overwrite a protected configuration file once the trailing dot is stripped by the Win32 layer.
Indirect prompt injection can hijack the AI agent to register a malicious MCP server or manipulate the ripgrepPath setting to execute an arbitrary binary during text searches. Microsoft fixed the flaw by adding a GetFullPath call before the file-name check to normalise paths and remove trailing dots prior to validation. The vendor advises applying the October 2026 updates urgently: Visual Studio 17.14.42 and SSMS 18.10.4, with affected 17.14.0 and 18.10.0 versions eligible for update. Administrators should restrict AI agents from processing untrusted repositories or MCP responses until patches are applied.