7.1
High
CVE-2025-47959 Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an…
Description
Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an authorized attacker to execute code over a network.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft Visual Studio 2022 version 17.12 17.12 | 17.12.0 → < 17.12.9 | 17.12.9 |
| Microsoft Visual Studio 2022 version 17.8 17.8 | 17.8.0 → < 17.8.22 | 17.8.22 |
| Microsoft Visual Studio 2022 version 17.10 17.10 | 17.10.0 → < 17.10.16 | 17.10.16 |
| Microsoft Visual Studio 2022 version 17.14 17.14 | 17.14.0 → < 17.14.5 | 17.14.5 |
References
- Visual Studio Remote Code Execution Vulnerability msrc.microsoft.com
Timeline
- Published
- Last modified
Other CVEs of Microsoft Visual Studio 2022 version 17.12
The 42 CVEs of Microsoft Visual Studio 2022 version 17.12 →
CVE-2026-50659
Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network
6.5
Medium
CVE-2026-50651
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a…
7.5
High
CVE-2026-50650
Improper control of generation of code ('code injection') in .NET Framework allows an unauthorized attacker to elevate…
7.8
High
CVE-2026-50649
Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally
7.8
High