# Visual Studio Copilot: a trailing dot let the agent rewrite its own config

> A trailing period defeated the check on which files Copilot may edit, letting an injected agent point the IDE at a binary it chose.

- **Severity:** High: A working attack on a widely used AI product or ecosystem. A fix may exist. Patch or mitigate this week.
- **Category:** Vulnerability, Attack
- **Published by:** Embrace The Red
- **Disclosed:** 2026-10-13
- **CVE:** CVE-2026-103572
- **CVSS:** 8.8
- **Affects:** Visual Studio 2026, Visual Studio 2022, SQL Server Management Studio, GitHub Copilot in Visual Studio
- **Research by:** [Johann Rehberger](https://embracethered.com/blog/)
- **Primary source:** https://embracethered.com/blog/posts/2026/visual-studio-copilot-remote-code-execution/
- **Page:** https://theinjection.dev/items/embracethered-visual-studio-copilot-rce/

CVE-2026-103572 let GitHub Copilot in Visual Studio and SSMS write to its own MCP and settings files by adding a trailing dot to a blocked path, turning a compromised agent into code execution. Microsoft fixed it on October 13.

## What happened

Microsoft published CVE-2026-103572 on October 13, 2026 and shipped the fix the same day in its October Patch Tuesday release. Johann Rehberger of Embrace The Red reported the path bypass to MSRC on August 4, 2026, Microsoft confirmed it on September 16, and he published his write-up on October 13. Rehberger notes the report earned no bounty.

## How it works

Windows saves a file name that ends in a period without that character, so settings.json and settings.json. are the same file. Copilot's confirmation check, GetEditConfirmationTypeAsync in Microsoft.VisualStudio.Copilot.Core.dll, compared path strings, so .mcp.json. passed while the write landed on .mcp.json. Rehberger chained the write into code execution two ways: adding an attacker-controlled MCP server that the IDE then launches, and overwriting the ripgrep path in settings.VisualStudio.json so a binary of his choice runs during a search. His proof of concept started calc.exe.

## Who is affected

Developers running Copilot in Visual Studio 2022 or Visual Studio 2026 are exposed, in the version ranges Microsoft lists in the table below. Rehberger reports that SQL Server Management Studio is affected too, because it shares the Copilot code with Visual Studio. Exploitation needs the agent to be injected or misaligned first, which is the threat model his post argues security controls must survive.

## What to do

Install the October 2026 Patch Tuesday updates for Visual Studio, and for SQL Server Management Studio alongside them. Rehberger's advice is to patch both. Because both attack chains work by writing agent configuration that the IDE later executes, review a project's .mcp.json and Visual Studio settings files for MCP servers or tool paths nobody added.

## Quick facts

- **CVE:** CVE-2026-103572
- **CVSS 3.1:** 8.8 (Microsoft)
- **Affected:** Visual Studio 2022 17.14.0 to before 17.14.42; Visual Studio 2026 18.10.0 to before 18.10.4
- **Fixed in:** Visual Studio 2022 17.14.42, Visual Studio 2026 18.10.4
- **Attack type:** Path validation bypass via trailing dot, agent config write
- **Found by:** Johann Rehberger (Embrace The Red)
- **Disclosed:** Reported August 4, 2026; patched October 13, 2026

## Questions

### Which Visual Studio versions fix CVE-2026-103572?

Visual Studio 2022 version 17.14.42 and Visual Studio 2026 version 18.10.4 fix CVE-2026-103572, according to Microsoft's CVE record. Earlier builds in the 17.14 and 18.10 lines are listed as affected. Johann Rehberger also reports that SQL Server Management Studio shares the vulnerable Copilot code, so SSMS installations deserve an update in the same pass.

### Is SQL Server Management Studio affected by CVE-2026-103572?

SQL Server Management Studio is affected, according to Johann Rehberger, who found the flaw and notes that SSMS shares Copilot code with Visual Studio. Microsoft's CVE title names both Visual Studio Tools for Applications and SQL Server Management Studio, though its machine-readable affected list shows only Visual Studio 2022 and Visual Studio 2026 builds. Administrators should patch SSMS as well.

### How does CVE-2026-103572 differ from the earlier SQL Copilot sysadmin flaw?

CVE-2026-103572 is a file path validation bypass that lets Copilot write its own MCP and settings files, which leads to code execution on the developer's machine. The earlier flaw Rehberger disclosed, CVE-2026-65669, was a read-only bypass inside SQL Server Management Studio that escalated a user to sysadmin in the database. Different mechanism, different target, same researcher.

### How can I tell whether an agent changed my MCP configuration?

Open the project's .mcp.json and the Visual Studio settings files and look for MCP servers or tool paths nobody added. Rehberger's two attack chains work by registering an attacker-controlled MCP server that the IDE then launches, or by repointing the ripgrep path so a chosen binary runs during a search. Entries naming unfamiliar commands deserve scrutiny.

## Sources

1. [Embrace The Red Post](https://embracethered.com/blog/posts/2026/visual-studio-copilot-remote-code-execution/)
2. [CVE Record](https://cveawg.mitre.org/api/cve/CVE-2026-103572)
3. [MSRC Advisory](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-103572)
4. [Windows Trailing Dots](https://learn.microsoft.com/en-us/troubleshoot/windows-client/shell-experience/file-folder-name-whitespace-characters)