CVE-2025-32702
Visual Studio Remote Code Execution Vulnerability
At a glance Severity HIGH 7.8 EPSS EPSS 0.62 % · percentile 50 (2026-10-27) State PUBLISHED Published 2025-05-13 Updated 2026-02-26 Assigner microsoft NVD status Analyzed Description Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an unauthorized attacker to execute code locally.
Scores Version Score Vector Scored by CVSS 3.1 HIGH 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C microsoft CVSS 3.1 HIGH 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H NVD · secure@microsoft.com (Secondary)
Weaknesses (CWE)
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:a:microsoft:visual_studio_2019:*:*:*:*:*:*:*:* ≥ 16.0 < 16.11.47cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:* ≥ 17.8.0 < 17.8.21cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:* ≥ 17.10.0 < 17.10.14cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:* ≥ 17.12.0 < 17.12.8cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:* ≥ 17.13.0 < 17.13.7Affected products
References
Sources
