Visual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572)

Microsoft patched a Remote Code Execution vulnerability (CVE-2026-103572, CVSS 8.8) in GitHub Copilot as integrated into Visual Studio and SQL Server Management Studio, disclosed by a researcher who reported it in August. The root cause is a path validation bypass exploiting Windows' handling of trailing dots in filenames (e.g. "settings.json." resolves to "settings.json"), which let Copilot write to protected configuration and MCP server files it should be blocked from modifying. Combined with path traversal and installation-ID disclosure via SSMS.isolation.ini, an attacker could use indirect prompt injection to hijack Copilot's AI model (MAI-Code-1-Flash) and achieve arbitrary command execution, demonstrated by popping calc.exe. The fix, shipped October 13, 2026 as part of Patch Tuesday, adds a GetFullPath call to normalize filenames and strip trailing dots. The researcher notes Microsoft awarded a $0 bounty despite confirming the vulnerability, the third such unrewarded report in two months.

Questions this post answers

CVE-2026-103572 is an Important-severity RCE vulnerability (CVSS 8.8) in Microsoft.VisualStudio.Copilot.Core.dll affecting Visual Studio and SQL Server Management Studio. It stems from a path validation bypass: Windows silently strips a trailing dot from filenames, so writing to "settings.json." actually targets "settings.json", letting Copilot bypass checks meant to block writes to protected config and MCP server files, enabling arbitrary command execution. Microsoft patched it on October 13, 2026 Patch Tuesday. Developers patching Copilot-enabled IDEs can track emerging AI agent CVEs like this one on daily.dev.

Windows Win32 APIs silently remove a trailing ASCII period (0x2E) from file and folder names before writing, even though the name technically differs at the string level. This means a validation check comparing "settings.json" against "settings.json." sees them as different strings and passes, but the actual write still lands on "settings.json" once the OS strips the dot, bypassing any string-based protected-filename check. Security engineers reviewing file validation logic can follow Windows canonicalization quirks like this on daily.dev.

The proof of concept instructed Copilot, via injected content, to create a file named settings.visualstudio.json. (with a trailing dot) setting the ripgrepPath configuration to C:\Windows\System32\calc.exe. Because of the trailing-dot bypass, the write actually targeted the real settings file, so the time Copilot performed a using ripgrep, it launched calc.exe instead, demonstrating arbitrary command execution via a misaligned AI agent. Teams assessing AI coding agent risk can follow real-world exploit demos like this on daily.dev.