Summary
Microsoft heeft kwetsbaarheden verholpen in Developer Tools.
Details
Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de categorieën schade, zoals beschreven in de onderstaande tabellen.
Met uitzondering van de kwetsbaarheid in .NET core, waarvoor geen voorafgaande authenticatie of gebruikersinteractie nodig is om een Denial-of-Service te veroorzaken, moet voor succesvol misbruik de kwaadwillende lokaal toegang hebben tot het kwetsbare systeem, of het slachtoffer misleiden een malafide broncodebestand te openen en uitvoeren.
```
Visual Studio Code:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-47287 | 6.50 | Manipulatie van gegevens |
| CVE-2026-47292 | 7.80 | Verkrijgen van verhoogde rechten |
| CVE-2026-40376 | 7.50 | Verkrijgen van verhoogde rechten |
| CVE-2026-47281 | 9.60 | Verkrijgen van verhoogde rechten |
| CVE-2026-47284 | 6.50 | Toegang tot gevoelige gegevens |
| CVE-2026-48569 | 7.10 | Omzeilen van beveiligingsmaatregel |
|----------------|------|-------------------------------------|
GitHub Copilot and Visual Studio Code:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-45482 | 8.40 | Omzeilen van beveiligingsmaatregel |
|----------------|------|-------------------------------------|
Microsoft Live Share Canvas SDK:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-45644 | 8.00 | Verkrijgen van verhoogde rechten |
|----------------|------|-------------------------------------|
ASP.NET Core:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-45591 | 7.50 | Denial-of-Service |
|----------------|------|-------------------------------------|
.NET:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-45490 | 7.80 | Verkrijgen van verhoogde rechten |
| CVE-2026-45491 | 6.20 | Manipulatie van gegevens |
|----------------|------|-------------------------------------|
```
Oplossingen
Microsoft heeft updates beschikbaar gesteld waarmee de beschreven kwetsbaarheden worden verholpen. We raden u aan om deze updates te installeren. Meer informatie over de kwetsbaarheden, de installatie van de updates en eventuele work-arounds vindt u op:
Vulnerabilities 11
-
Critical 9.6
Visual Studio Code Elevation of Privilege Vulnerability
Missing authorization in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.
-
High 8.4
Microsoft Visual Studio Code CoPilot Chat Security Feature Bypass Vulnerability
Improper limitation of a pathname to a restricted directory ('path traversal') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
-
High 8.0
Microsoft Live Share Canvas SDK Elevation of Privilege Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Live Share Canvas SDK allows an authorized attacker to elevate privileges over a network.
-
High 7.8
.NET SDK Elevation of Privilege Vulnerability
Improper authorization in .NET allows an authorized attacker to elevate privileges locally.
-
High 7.8
Visual Studio Code MSSQL Extension Remote Code Execution Vulnerability
Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to elevate privileges locally.
-
High 7.5
Visual Studio Code Elevation of Privilege Vulnerability
Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.
-
High 7.5
ASP.NET Core Denial of Service Vulnerability
Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.
-
High 7.1
Visual Studio Code Security Feature Bypass Vulnerability
Improper input validation in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
-
Medium 6.5
Visual Studio Code Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Visual Studio Code allows an unauthorized attacker to disclose information over a network.
-
Medium 6.5
Visual Studio Code Tampering Vulnerability
Relative path traversal in Visual Studio Code allows an unauthorized attacker to perform tampering over a network.
-
Medium 6.2
.NET Tampering Vulnerability
Improper link resolution before file access ('link following') in .NET allows an unauthorized attacker to perform tampering locally.
Revision history
-
#1.0.0
Initiele versie