Executive brief
Microsoft Visual Studio, a widely used software development environment, contains a security flaw that could allow an attacker to execute malicious code on a developer's computer. To exploit this, an attacker would typically need to trick a user into opening a specially crafted file or project. If successful, the attacker could gain the same permissions as the local user, potentially leading to data theft or full system compromise.
Technical details
A protection mechanism failure (CWE-693) exists in multiple versions of Microsoft Visual Studio, including 2022 and 2026. The vulnerability is triggered when the application fails to properly enforce security boundaries, allowing for local code execution. While the attack vector is local, it requires user interaction (UI:R), suggesting the exploit involves a victim opening a malicious file or project. Successful exploitation grants the attacker high-impact capabilities across confidentiality, integrity, and availability. Microsoft has released security updates to address this issue in the affected versions.
Affected products
- Microsoft Visual Studio 2022 version 17.12 17.12.0 to 17.12.22
- Microsoft Visual Studio 2022 version 17.14 17.14.0 to 17.14.36
- Microsoft Visual Studio 2026 version 18.7 18.0 to 18.7.4
Timeline
- 2026-07-14: advisory: Initial publication of CVE-2026-47305 by Microsoft and NVD.