Microsoft Visual Studio 2022 vulnerabilities
155 vulnerabilities
Known vulnerabilities in Microsoft Visual Studio 2022, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2026-96957microsoftmicrosoft visual studio 2022 version 17.14+6
EPSS score0.45%
Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-88092chainguarddotnet-bootstrap-8+23EPSS score0.79%
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.CVE-2026-85790microsoftmicrosoft visual studio 2022 version 17.14+19EPSS score0.69%
Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.CVE-2021-43877microsoftasp.net_core+10EPSS score0.73%
ASP.NET Core and Visual Studio Elevation of Privilege VulnerabilityCVE-2025-21405microsoftmicrosoft visual studio 2022 version 17.12+1EPSS score0.52%
Visual Studio Elevation of Privilege VulnerabilityCVE-2025-21173chainguarddotnet-bootstrap-9+12EPSS score1.24%
.NET Elevation of Privilege VulnerabilityCVE-2025-21206microsoftmicrosoft visual studio 2017 version 15.9 (includes 15.0 - 15.8)+7EPSS score0.69%
Visual Studio Installer Elevation of Privilege VulnerabilityCVE-2025-21178microsoftmicrosoft visual studio 2015 update 3+9EPSS score1.58%
Visual Studio Remote Code Execution VulnerabilityCVE-2025-21171chainguarddotnet-bootstrap-9+23EPSS score1.70%
.NET Remote Code Execution VulnerabilityCVE-2025-21172chainguarddotnet-bootstrap-9+29EPSS score1.81%
.NET and Visual Studio Remote Code Execution VulnerabilityCVE-2025-55248chainguarddotnet-bootstrap-8+37EPSS score0.72%
Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to disclose information over a network.CVE-2025-55315chainguardazure-functions-extension-bundles-4+34EPSS score65.94%
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.CVE-2025-55240microsoftmicrosoft visual studio 2017 version 15.9 (includes 15.0 - 15.8)+7EPSS score0.37%
Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally.CVE-2025-62214microsoftmicrosoft visual studio 2022 version 17.14+1EPSS score1.11%
Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an authorized attacker to execute code locally.CVE-2025-26646chainguarddotnet-8+66EPSS score1.27%
External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a network.CVE-2025-26682ubuntudotnet6+11EPSS score1.71%
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.CVE-2025-47959microsoftmicrosoft visual studio 2022 version 17.10+4EPSS score10.94%
Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an authorized attacker to execute code over a network.CVE-2025-25003microsoftmicrosoft visual studio 2019 version 16.11 (includes 16.0 - 16.10)+6EPSS score0.46%
Uncontrolled search path element in Visual Studio allows an authorized attacker to elevate privileges locally.CVE-2025-53773microsoftmicrosoft visual studio 2022 version 17.14+1EPSS score3.24%
Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to execute code locally.CVE-2025-29804microsoftmicrosoft visual studio 2022 version 17.10+4EPSS score1.29%
Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally.