Summary
Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
What privileges could be gained by an attacker who successfully exploited the vulnerability?
An attacker who successfully exploited this vulnerability could execute code in the context of another Visual Studio Code user on the vulnerable system.
According to the CVSS metric, the attack complexity is high (AC:H). What does this mean for this vulnerability?
An attacker would need specific conditions to be in place (i.e. particular protocol settings, or configurations, etc.) before an attack could succeed, which reduces the likelihood of widespread or opportunistic exploitation.
Security updates
1.145.3 — https://code.visualstudio.com/updates/v1_145
Vulnerabilities 1
-
High 7.0
Visual Studio Code Elevation of Privilege Vulnerability
Missing authentication for critical function in Visual Studio Code allows an authorized attacker to elevate privileges locally.
Revision history
-
#1
Information published.
References
-
CVE-2026-119981 Visual Studio Code Elevation of Privilege Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119981
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss