Vulnerabilities fixed in Microsoft Developer Tools

Microsoft fixed vulnerabilities in Visual Studio and .NET A malicious party could exploit the vulnerabilities to grant themselves elevated privileges and/or execute arbitrary code with developer privileges. Because developers tend to work under elevated privileges, it cannot be ruled out that...

CVE-2025-26631

Uncontrolled search path element in Visual Studio Code allows an authorized attacker to elevate privileges locally...

CVE-2025-26631

Uncontrolled search path element in Visual Studio Code allows an authorized attacker to elevate privileges locally...

CVE-2025-25003

Uncontrolled search path element in Visual Studio allows an authorized attacker to elevate privileges locally...

CVE-2025-25003

Uncontrolled search path element in Visual Studio allows an authorized attacker to elevate privileges locally...

CVE-2025-24998

Uncontrolled search path element in Visual Studio allows an authorized attacker to elevate privileges locally...

CVE-2025-24998

Uncontrolled search path element in Visual Studio allows an authorized attacker to elevate privileges locally...

CVE-2025-24070

Weak authentication in ASP.NET Core & Visual Studio allows an unauthorized attacker to elevate privileges over a network...

CVE-2025-24070

Weak authentication in ASP.NET Core & Visual Studio allows an unauthorized attacker to elevate privileges over a network...

CVE-2025-26631 Visual Studio Code Elevation of Privilege Vulnerability

...

CVE-2025-26631 Visual Studio Code Elevation of Privilege Vulnerability

...

CVE-2025-26631

CVE-2025-26631 affects Visual Studio Code and is described as an Uncontrolled search path element that can allow an authorized, local attacker to escalate privileges. Connected sources (e.g., Nessus plugin for Microsoft Visual Studio Code security update) note that the issue affects installations...

CVE-2025-24998 Visual Studio Elevation of Privilege Vulnerability

...

CVE-2025-25003

CVE-2025-25003 affects Visual Studio and is described as an Elevation of Privilege vulnerability caused by an Uncontrolled search path element. The CVE entry indicates local privilege escalation with high impact; exploitation details are not provided in the documents. Microsoft has published upda...

CVE-2025-25003 Visual Studio Elevation of Privilege Vulnerability

...

CVE-2025-24998

CVE-2025-24998 is an Elevation of Privilege vulnerability in Visual Studio caused by an Uncontrolled search path element. A local attacker with low privileges and user interaction can potentially escalate to higher privileges. CVSSv3 base score 7.3 (HIGH); impact on confidentiality, integrity, an...

CVE-2025-24998 Visual Studio Elevation of Privilege Vulnerability

...

CVE-2025-25003 Visual Studio Elevation of Privilege Vulnerability

...

CVE-2025-24070 ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability

...

CVE-2025-24070

The CVE describes a weak authentication issue in ASP.NET Core and Visual Studio that could allow elevation of privilege via calls to RefreshSignInAsync with an improperly authenticated user parameter. Affected software includes ASP.NET Core apps using Microsoft.AspNetCore.Identity (affected versi...