CVE-2026-103572

CVE-2026-103572 is a code injection flaw (CWE-94) in the GitHub Copilot integration of Visual Studio and SQL Server Management Studio (SSMS). Microsoft fixed it in the 13 October 2026 Patch Tuesday release.

Microsoft scores it CVSS 3.1 8.8 and rates it Important, with impact Remote Code Execution. NVD shows the Microsoft score and is still awaiting analysis. Microsoft marks it not publicly disclosed and not exploited, with exploitability "Exploitation Less Likely".

Microsoft's FAQ says an attacker can deliver a malicious prompt over the network without prior access. A user must interact with Copilot. Prompt injection can then make Copilot run attacker-controlled instructions.

Fixed builds are Visual Studio 2022 17.14.42 and Visual Studio 2026 18.10.4. Microsoft's title names SSMS, but its affected list has no SSMS build. SSMS 22.11.0 shipped the same day; its release notes do not name this CVE.

Microsoft credits Johann Rehberger (Embrace The Red). His write-up says the flaw lets Copilot bypass a file path check and edit its own protected configuration. That leads to command execution. He reports SSMS shares the vulnerable Copilot component.

The CVE is not in the CISA KEV catalog. CISA's SSVC entry says exploitation: none. No exploitation in the wild is reported.

Researcher Johann Rehberger published a technical write-up with proof-of-concept demonstrations. In them, prompt injection leads Copilot to modify its protected config and launch a rogue MCP server. ThreatWire has not reproduced them. He says a trailing dot in a file name bypassed the protected-file check. He says Microsoft's fix normalizes paths (GetFullPath). The PoC link field points to the write-up.