MSRC (Oct 13) rates CVE-2026-103572 as an Important remote code execution bug, CVSS 8.8 (AV:N/UI:R), not exploited, not publicly disclosed, "Exploitation Less Likely". MSRC's product list covers Visual Studio 2026 18.10 (fixed in 18.10.4) and Visual Studio 2022 17.14 (fixed in 17.14.42). The advisory title also names SQL Server Management Studio, so update SSMS too. Johann Rehberger's write-up: Copilot's protected-file check compared raw strings, so writing .mcp.json. or settings.VisualStudio.json. passed validation, then Win32 stripped the trailing dot and the write hit the real file. A prompt-injected agent could register a malicious MCP server or point ripgrepPath at any binary. The fix adds GetFullPath normalization. Lesson: canonicalize paths before policy checks, and make guardrails hold even when the agent itself is hijacked. Rehberger says the bounty was $0.