Description
Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an unauthorized attacker to execute code locally.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Microsoft | Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) | 16.11.0 – < 16.11.47 | 16.11.47 |
| Microsoft | Microsoft Visual Studio 2022 version 17.10 | 17.10.0 – < 17.10.14 | 17.10.14 |
| Microsoft | Microsoft Visual Studio 2022 version 17.12 | 17.12.0 – < 17.12.8 | 17.12.8 |
| Microsoft | Microsoft Visual Studio 2022 version 17.13 | 17.13.0 – < 17.13.7 | 17.13.7 |
| Microsoft | Microsoft Visual Studio 2022 version 17.8 | 17.8.0 – < 17.8.21 | 17.8.21 |
Advisories 3
- WID-SEC-2025-1015 Microsoft Developer Tools: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 1, 2025
- NCSC-2025-0153 Kwetsbaarheden verholpen in Microsoft Developer Tools NCSC-NL (Netherlands) · May 13, 2025
- MSRC-CVE-2025-32702 Visual Studio Remote Code Execution Vulnerability Microsoft Security Response Center · May 13, 2025
References
- Visual Studio Remote Code Execution Vulnerability vendor-advisory patch