7.3
High
CVE-2025-24998 Uncontrolled search path element in Visual Studio allows an authorized attacker to elevate privileges locally
Description
Uncontrolled search path element in Visual Studio allows an authorized attacker to elevate privileges locally.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft Visual Studio 2022 version 17.13 17.13 | 17.13.0 → < 17.13.3 | 17.13.3 |
| Microsoft Visual Studio 2022 version 17.12 17.12 | 17.12.0 → < 17.12.6 | 17.12.6 |
| Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) 15.9 | 15.9.0 → < 15.9.71 | 15.9.71 |
| Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) 16.11 | 16.11.0 → < 16.11.45 | 16.11.45 |
| Microsoft Visual Studio 2022 version 17.8 17.8 | 17.8.0 → < 17.8.19 | 17.8.19 |
| Microsoft Visual Studio 2022 version 17.10 17.10 | 17.10.0 → < 17.10.12 | 17.10.12 |
References
- Visual Studio Elevation of Privilege Vulnerability msrc.microsoft.com
Timeline
- Published
- Last modified
Other CVEs of Microsoft Visual Studio 2022 version 17.13
The 8 CVEs of Microsoft Visual Studio 2022 version 17.13 →
CVE-2025-26646
External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized…
8.0
High
CVE-2025-32702
Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an…
7.8
High
CVE-2025-32703
Insufficient granularity of access control in Visual Studio allows an authorized attacker to disclose information…
5.5
Medium
CVE-2025-26682
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service…
7.5
High