CVE-2024-20656

HIGH
2024-01-09 [email protected]
7.8
CVSS 3.1
Share

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Analysis Generated
Mar 28, 2026 - 19:34 vuln.today
Patch Released
Mar 28, 2026 - 19:34 nvd
Patch available
CVE Published
Jan 09, 2024 - 18:15 nvd
HIGH 7.8

Tags

Information Disclosure Visual Studio Visual Studio 2017 Visual Studio 2019 Visual Studio 2022

Description

Visual Studio Elevation of Privilege Vulnerability

Analysis

Visual Studio contains an elevation of privilege vulnerability that allows local attackers to escalate privileges through symlink exploitation. Successful exploitation grants elevated permissions on the development workstation, potentially compromising the software supply chain.

Technical Context

The vulnerability exploits improper symlink handling in Visual Studio operations. A local attacker can create symbolic links that redirect Visual Studio file operations to privileged locations, achieving write access to protected system areas. This can be leveraged for privilege escalation or code injection into the Visual Studio build pipeline.

Affected Products

['Visual Studio (multiple versions)']

Remediation

Apply the January 2024 Microsoft security update. Implement least-privilege access on developer workstations. Monitor build environments for unexpected symlinks. Use build verification and code signing for release pipelines.

Priority Score

93
Low Medium High Critical
KEV: 0
EPSS: +54.3
CVSS: +39
POC: 0

Share

CVE-2024-20656 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy