What is the CVSS score of CVE-2025-47959?

CVE-2025-47959 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Windows are affected by CVE-2025-47959?

Visual Studio contains a command injection vulnerability (CVE-2025-47959, CVSS 7.1) that allows authenticated users to execute arbitrary code through local user interaction, potentially compromising…. A patch is available.

How to fix or mitigate CVE-2025-47959?

Within 24 hours: Identify all Visual Studio installations across development teams using asset inventory tools and check current version levels against vendor advisory. Within 7 days: Apply the latest Visual Studio patch released by Microsoft for this CVE across all affected instances; prioritize shared development machines and CI/CD integration servers. Within 30 days: Conduct access reviews on Visual Studio instances to enforce principle of least privilege, disable unnecessary network features in IDE settings, and implement monitoring for abnormal command execution patterns from developer workstations.

Windows CVE-2025-47959

EUVD-2025-18227 HIGH

Command Injection (CWE-77)

2025-06-13 secure@microsoft.com

Command Injection Microsoft Windows RCE Visual Studio 2022

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:39 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

17.12.9,17.10.16,17.8.22

EUVD ID Assigned

Mar 14, 2026 - 21:34 euvd

EUVD-2025-18227

Analysis Generated

Mar 14, 2026 - 21:34 vuln.today

CVE Published

Jun 13, 2025 - 02:15 nvd

HIGH 7.1

DescriptionCVE.org

Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an authorized attacker to execute code over a network.

AnalysisAI

Command injection vulnerability in Visual Studio that allows an authenticated attacker with local user interaction to execute arbitrary code over a network with high impact on confidentiality, integrity, and availability. While the vulnerability requires prior authorization and user interaction, successful exploitation could lead to complete system compromise. No public indication of active exploitation or widespread POC availability is currently documented, but the CVSS 7.1 score reflects significant risk in collaborative development environments where multiple authorized users access shared Visual Studio instances.

Technical ContextAI

This vulnerability exists in Visual Studio's command processing mechanisms, likely within build system integration, debugging interfaces, or extension handling where user-supplied input is insufficiently sanitized before being passed to system command interpreters. CWE-77 (Improper Neutralization of Special Elements used in a Command) indicates the root cause is inadequate input validation/encoding before command construction—a classic command injection flaw where special shell metacharacters (pipes, semicolons, backticks, command substitution operators) are not properly escaped. The vulnerability affects Visual Studio 2019, 2022, and potentially related Microsoft development tools that process build configurations, debugging parameters, or project file attributes. The network attack vector suggests the injection point may involve remote debugging, build pipeline integrations, or project file parsing from network sources rather than purely local file system operations.

RemediationAI

Immediate actions: (1) Apply Microsoft security patches for Visual Studio released concurrently with CVE-2025-47959 disclosure—check Microsoft Update, Windows Update, or Visual Studio Installer for available updates; (2) For projects using untrusted build configurations or remote debugging: disable network-accessible debug endpoints, enforce code review on .sln/.vcxproj/.csproj files before opening in Visual Studio, and restrict project file sources to trusted repositories; (3) Operational mitigations: enforce least-privilege user accounts for development, isolate development machines from production networks, monitor Visual Studio process execution for anomalous command spawning. Workarounds pending patch availability: avoid opening project files from untrusted sources, disable C++ IntelliSense indexing if implicated, restrict debugging to local connections only. Link to Microsoft Security Update Guide for specific KB articles and patched versions once available.