Description
Uncontrolled search path element in Visual Studio Tools for Applications and SQL Server Management Studio allows an authorized attacker to elevate privileges locally.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Microsoft | SQL Server Management Studio 20.2 | 20.0 – < 20.2.37.0 | 20.2.37.0 |
| Microsoft | Visual Studio Tools for Applications (VSTA) | 16.0 – < 16.0.35907.0, 17.0 – < 17.0.35906.0 | 16.0.35907.0 |
| Microsoft | VSTA 2019 SDK | 16.0 – < 16.0.35907.0 | 16.0.35907.0 |
| Microsoft | VSTA 2022 SDK | 17.0 – < 17.0.35906.0 | 17.0.35906.0 |
Advisories 4
- WID-SEC-2025-0748 Microsoft DeveloperTools: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 18, 2025
- WID-SEC-2025-0746 Microsoft SQL Server: Schwachstelle ermöglicht Privilegieneskalation BSI CERT-Bund (WID) · Apr 8, 2025
- NCSC-2025-0110 Kwetsbaarheden verholpen in Microsoft Developer Tools NCSC-NL (Netherlands) · Apr 8, 2025
- MSRC-CVE-2025-29803 Visual Studio Tools for Applications and SQL Server Management Studio Elevation of Privilege Vulnerability Microsoft Security Response Center · Apr 8, 2025