MSRC-CVE-2026-21257 — GitHub Copilot and Visual Studio Elevation of Privilege Vulnerability

Summary

Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

What privileges could be gained by an attacker who successfully exploited the vulnerability?
The attacker would gain the rights of the user that is running the affected application.

Security updates
17.14.26 — https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes
18.3.0 — https://learn.microsoft.com/en-us/visualstudio/releases/2026/release-notes

Vulnerabilities 1

High 8.0

CVE-2026-21257

GitHub Copilot and Visual Studio Elevation of Privilege Vulnerability

Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an authorized attacker to elevate privileges over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft Visual Studio 2026 version 18.3

Feb 10, 2026

Revision history

2026-03-13 #2
Changes made to the security updates links and information. This is an informational change only.
2026-02-10 #1
Information published.

References

CVE-2026-21257 GitHub Copilot and Visual Studio Elevation of Privilege Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21257
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss