Microsoft's October 13 monthly patch release fixes a Copilot-related remote code execution vulnerability, tracked as CVE-2026-103572. It affects Visual Studio (including 2026, 2022 and other older versions) and SQL Server Management Studio (SSMS). It was found by security researcher Johann Rehberger, who published the technical details the same day on his blog, Embrace The Red.
Both products share a core library, Microsoft.VisualStudio.Copilot.Core.dll, and the bug lives there, so a single flaw hits both.
How one period gets past the check
Copilot can write files on a user's behalf inside the IDE, but configuration files such as .mcp.json and Visual Studio's settings files are designated as protected and off limits to it. The problem is in how the check works: the validation logic compares raw strings.
Windows has a long-standing rule at the Win32 layer that trailing periods in file names are stripped automatically. Rehberger quotes Microsoft's own documentation: "File and Folder names that end with the ASCII Period (0x2E) character will also be saved without this character." So at validation time, settings.json. is not the same string as settings.json, and the check lets it through. When the file is actually written to disk, the trailing dot is dropped, and what gets written is the protected file itself.
The attack chain runs roughly like this. An attacker first influences Copilot through indirect prompt injection, for example by having an MCP server return data with instructions tucked inside. Copilot follows them and writes the attacker's content into a config file such as .mcp.json. When the IDE reads that configuration, it launches a malicious command. In Visual Studio, changing certain tool-path settings can also trigger command execution.
Rehberger reported a few other problems along the way: path traversal with ..\ could read restricted files, some files leaked installation identifiers, and the MAI-Code-1-Flash model showed weak resistance to indirect prompt injection. By his analysis, Microsoft's fix adds a GetFullPath call that normalizes the path first, stripping trailing dots and resolving .., before doing the comparison.
The second bug of the same kind
This is not the first time Rehberger has gone after configuration files. In August 2025 he disclosed a remote code execution flaw in GitHub Copilot inside VS Code (CVE-2025-53773): prompt injection made Copilot rewrite the workspace's settings.json, switching on the option that lets tools run without confirmation, after which commands could be executed directly. That one was also fixed in a Microsoft Patch Tuesday release.
Seen together, the pattern is the same. The agent is allowed to write files, configuration files decide what the agent and the IDE can do, and as long as the agent can be made to write to its own configuration, it escalates its own privileges. The lesson from 2025 was to add a protected-file list, and the layer bypassed this time is exactly that list. Rehberger's summary in his post:
"Security controls around agents must hold even when the agent itself is compromised or misaligned."
What users should do
On the timeline, Rehberger submitted his report on August 4, added Visual Studio impact and exploitation details between August 4 and 7, and followed up on August 30. Microsoft confirmed the issue on September 16, told him on October 11 that the bounty would be $0, and shipped the fix on October 13. The public materials do not explain why Microsoft awarded no bounty.
For teams using Visual Studio and SSMS, there is only one thing to do: install this month's patch as soon as possible. Environments where Copilot connects to third-party MCP servers are at higher risk, because those external data sources are exactly where prompt injection enters.
Sources: Embrace The Red blog, CocoLoop, Microsoft Security Update Guide. The CVE number, CVSS score and disclosure milestones are as given in the researcher's blog and Microsoft's advisory.