Summary
Microsoft heeft kwetsbaarheden verholpen in diverse Developer Tools.
Details
Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de categorieën schade zoals benoemd in onderstaande tabel.
Voor succesvol misbruik moet de kwaadwillende het slachtoffer misleiden een malafide broncodebestand te importeren en verwerken.
```
Visual Studio Code CoPilot Chat Extension:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-65675 | 7.10 | Omzeilen van beveiligingsmaatregel |
|----------------|------|-------------------------------------|
Microsoft PowerShell Core:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-58612 | 7.40 | Toegang tot gevoelige gegevens |
| CVE-2026-70337 | 8.80 | Uitvoeren van willekeurige code |
|----------------|------|-------------------------------------|
GitHub Copilot and Visual Studio Code:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-70335 | 7.80 | Verkrijgen van verhoogde rechten |
|----------------|------|-------------------------------------|
Visual Studio Code:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-58650 | 7.80 | Omzeilen van beveiligingsmaatregel |
| CVE-2026-59113 | 8.80 | Uitvoeren van willekeurige code |
| CVE-2026-47285 | 6.50 | Toegang tot gevoelige gegevens |
| CVE-2026-69320 | 8.80 | Uitvoeren van willekeurige code |
| CVE-2026-69278 | 7.80 | Omzeilen van beveiligingsmaatregel |
| CVE-2026-69306 | 8.20 | Omzeilen van beveiligingsmaatregel |
| CVE-2026-70336 | 8.80 | Uitvoeren van willekeurige code |
|----------------|------|-------------------------------------|
.NET Framework:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-62897 | 7.00 | Uitvoeren van willekeurige code |
| CVE-2026-62872 | 8.80 | Verkrijgen van verhoogde rechten |
| CVE-2026-65810 | 7.80 | Verkrijgen van verhoogde rechten |
|----------------|------|-------------------------------------|
Microsoft PowerShell:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-59119 | 7.30 | Verkrijgen van verhoogde rechten |
| CVE-2026-70338 | 7.80 | Omzeilen van beveiligingsmaatregel |
|----------------|------|-------------------------------------|
.NET:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-62899 | 5.90 | Omzeilen van beveiligingsmaatregel |
| CVE-2026-62900 | 5.90 | Toegang tot gevoelige gegevens |
| CVE-2026-62901 | 7.50 | Denial-of-Service |
| CVE-2026-62902 | 6.50 | Toegang tot gevoelige gegevens |
| CVE-2026-62909 | 7.80 | Verkrijgen van verhoogde rechten |
| CVE-2026-58641 | 7.80 | Verkrijgen van verhoogde rechten |
| CVE-2026-62871 | 7.80 | Uitvoeren van willekeurige code |
| CVE-2026-62886 | 7.80 | Verkrijgen van verhoogde rechten |
| CVE-2026-70354 | 7.80 | Uitvoeren van willekeurige code |
|----------------|------|-------------------------------------|
Visual Studio Code - Python extension:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-54981 | 7.80 | Omzeilen van beveiligingsmaatregel |
|----------------|------|-------------------------------------|
```
Oplossingen
Microsoft heeft updates beschikbaar gesteld waarmee de beschreven kwetsbaarheden worden verholpen. We raden u aan om deze updates te installeren. Meer informatie over de kwetsbaarheden, de installatie van de updates en eventuele work-arounds vindt u op:
Vulnerabilities 26
-
High 8.8
Visual Studio Code Remote Code Execution Vulnerability
Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.
-
High 8.8
.NET Framework Elevation of Privilege Vulnerability
Incorrect authorization in .NET Framework allows an authorized attacker to elevate privileges over a network.
-
High 8.8
Visual Studio Code Remote Code Execution Vulnerability
Improper neutralization of special elements used in an os command ('os command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
-
High 8.8
Visual Studio Code Remote Code Execution Vulnerability
Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft PowerShell Remote Code Execution Vulnerability
Relative path traversal in Microsoft PowerShell Core allows an unauthorized attacker to execute code over a network.
-
High 8.2
Visual Studio Code Security Feature Bypass Vulnerability
Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
-
High 7.8
Visual Studio Code Python Extension Security Feature Bypass Vulnerability
Inclusion of functionality from untrusted control sphere in Visual Studio Code - Python extension allows an unauthorized attacker to bypass a security feature locally.
-
High 7.8
.NET Elevation of Privilege Vulnerability
Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.
-
High 7.8
Visual Studio Code Security Feature Bypass Vulnerability
Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
-
High 7.8
.NET Elevation of Privilege Vulnerability
Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.
-
High 7.8
.NET Elevation of Privilege Vulnerability
Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.
-
High 7.8
.NET Elevation of Privilege Vulnerability
Uncaught exception in .NET allows an authorized attacker to elevate privileges locally.
-
High 7.8
.NET Framework Elevation of Privilege Vulnerability
Relative path traversal in .NET Framework allows an unauthorized attacker to elevate privileges locally.
-
High 7.8
Visual Studio Code Security Feature Bypass Vulnerability
Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
-
High 7.8
GitHub Copilot and Visual Studio Code Elevation of Privilege Vulnerability
Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to elevate privileges locally.
-
High 7.8
Microsoft PowerShell Security Feature Bypass Vulnerability
Improper control of generation of code ('code injection') in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally.
-
High 7.8
.NET Core Remote Code Execution Vulnerability
Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.
-
High 7.5
.NET Denial of Service Vulnerability
Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network.
-
High 7.4
PowerShell Information Disclosure Vulnerability
Server-side request forgery (ssrf) in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over a network.
-
High 7.3
PowerShell Elevation of Privilege Vulnerability
Incorrect default permissions in Microsoft PowerShell allows an authorized attacker to elevate privileges locally.
-
High 7.1
CoPilot Chat Security Feature Bypass Vulnerability
No cwe for this issue in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to bypass a security feature over a network.
-
High 7.0
.NET Framework Remote Code Execution Vulnerability
Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to execute code locally.
-
Medium 6.5
Visual Studio Code Information Disclosure Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to disclose information over a network.
-
Medium 6.5
.NET Information Disclosure Vulnerability
Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to disclose information over a network.
-
Medium 5.9
.NET Security Feature Bypass Vulnerability
Inconsistent interpretation of http requests ('http request/response smuggling') in .NET allows an unauthorized attacker to bypass a security feature over a network.
-
Medium 5.9
.NET Information Disclosure Vulnerability
Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network.
Revision history
-
#1.0.0
Initiele versie