MSRC-CVE-2025-26631 — Visual Studio Code Elevation of Privilege Vulnerability

Summary

Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

What privileges could be gained by an attacker who successfully exploited this vulnerability?
An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

According to the CVSS metric, user interaction is required (UI:R) and privileges required is low (PR:L). What does that mean for this vulnerability?
An authorized attacker must send the user a malicious file and convince the user to open it.

Security updates
1.98.0 — https://code.visualstudio.com/updates/v1_98

Vulnerabilities 1

High 7.3

CVE-2025-26631

Visual Studio Code Elevation of Privilege Vulnerability

Uncontrolled search path element in Visual Studio Code allows an authorized attacker to elevate privileges locally.

Microsoft Visual Studio Code

Mar 11, 2025

Revision history

2025-03-11 #1
Information published.

References

CVE-2025-26631 Visual Studio Code Elevation of Privilege Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26631
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss