Microsoft Visual Studio 2022 Version 17.10 vulnerabilities
38 vulnerabilities
Known vulnerabilities in Microsoft Visual Studio 2022 Version 17.10, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2025-21173chainguarddotnet-bootstrap-9+12
EPSS score1.24%
.NET Elevation of Privilege VulnerabilityCVE-2025-21176chainguarddotnet-bootstrap-9+36EPSS score2.35%
.NET, .NET Framework, and Visual Studio Remote Code Execution VulnerabilityCVE-2025-21206microsoftmicrosoft visual studio 2017 version 15.9 (includes 15.0 - 15.8)+7EPSS score0.69%
Visual Studio Installer Elevation of Privilege VulnerabilityCVE-2025-21178microsoftmicrosoft visual studio 2015 update 3+9EPSS score1.58%
Visual Studio Remote Code Execution VulnerabilityCVE-2025-21171chainguarddotnet-bootstrap-9+23EPSS score1.70%
.NET Remote Code Execution VulnerabilityCVE-2025-21172chainguarddotnet-bootstrap-9+29EPSS score1.81%
.NET and Visual Studio Remote Code Execution VulnerabilityCVE-2025-55248chainguarddotnet-bootstrap-8+37EPSS score0.72%
Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to disclose information over a network.CVE-2025-55315chainguardazure-functions-extension-bundles-4+34EPSS score66.53%
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.CVE-2025-55240microsoftmicrosoft visual studio 2017 version 15.9 (includes 15.0 - 15.8)+7EPSS score0.37%
Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally.CVE-2025-26646chainguarddotnet-8+66EPSS score1.27%
External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a network.CVE-2025-26682ubuntudotnet6+11EPSS score1.71%
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.CVE-2025-47959microsoftmicrosoft visual studio 2022 version 17.10+4EPSS score10.94%
Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an authorized attacker to execute code over a network.CVE-2025-25003microsoftmicrosoft visual studio 2019 version 16.11 (includes 16.0 - 16.10)+6EPSS score0.46%
Uncontrolled search path element in Visual Studio allows an authorized attacker to elevate privileges locally.CVE-2025-29804microsoftmicrosoft visual studio 2022 version 17.10+4EPSS score1.29%
Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally.CVE-2025-29802microsoftmicrosoft visual studio 2022 version 17.10+3EPSS score0.95%
Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally.CVE-2025-24070ubuntudotnet6+67EPSS score1.01%
Weak authentication in ASP.NET Core & Visual Studio allows an unauthorized attacker to elevate privileges over a network.CVE-2025-24998microsoftmicrosoft visual studio 2017 version 15.9 (includes 15.0 - 15.8)+8EPSS score0.46%
Uncontrolled search path element in Visual Studio allows an authorized attacker to elevate privileges locally.CVE-2025-49739microsoftmicrosoft visual studio 2015 update 3+10EPSS score0.95%
Improper link resolution before file access ('link following') in Visual Studio allows an unauthorized attacker to elevate privileges over a network.CVE-2025-32702microsoftmicrosoft visual studio 2019 version 16.11 (includes 16.0 - 16.10)+6EPSS score0.62%
Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an unauthorized attacker to execute code locally.CVE-2025-32703microsoftmicrosoft visual studio 2017 version 15.9 (includes 15.0 - 15.8)+8EPSS score0.50%
Insufficient granularity of access control in Visual Studio allows an authorized attacker to disclose information locally.