Skip to main content

Visual Studio CVE-2025-49739

| EUVDEUVD-2025-20538 HIGH
Improper Link Resolution Before File Access (CWE-59)
2025-07-08 secure@microsoft.com
Authentication Bypass Microsoft Visual Studio Visual Studio 2017 Visual Studio 2019 Visual Studio 2022
8.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Analysis Updated
Apr 16, 2026 - 06:28 EUVD-patch-fix
executive_summary
Re-analysis Queued
Apr 16, 2026 - 05:29 backfill_euvd_patch
patch_released
Patch available
Apr 16, 2026 - 05:29 EUVD
15.9.75,17.10.17,16.11.49
EUVD ID Assigned
Mar 16, 2026 - 04:21 euvd
EUVD-2025-20538
Analysis Generated
Mar 16, 2026 - 04:21 vuln.today
CVE Published
Jul 08, 2025 - 17:16 nvd
HIGH 8.8

DescriptionCVE.org

Improper link resolution before file access ('link following') in Visual Studio allows an unauthorized attacker to elevate privileges over a network.

Analysis

Improper link resolution before file access ('link following') in Visual Studio allows an unauthorized attacker to elevate privileges over a network.

Technical ContextAI

This vulnerability is classified as Improper Link Resolution Before File Access (CWE-59).

RemediationAI

Monitor vendor advisories for patches. Apply mitigations such as network segmentation, access restrictions, and monitoring.

More in Visual Studio

View all
CVE-2022-35827 HIGH
8.8 Aug 09

Visual Studio Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
CVE-2022-35826 HIGH
8.8 Aug 09

Visual Studio Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
CVE-2022-35825 HIGH
8.8 Aug 09

Visual Studio Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
CVE-2022-35777 HIGH
8.8 Aug 09

Visual Studio Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
CVE-2014-3802 MEDIUM
6.8 May 20

msdia.dll in Microsoft Debug Interface Access (DIA) SDK, as distributed in Microsoft Visual Studio before 2013, does not
CVE-2023-24897 HIGH
7.8 Jun 14

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulner
CVE-2021-28322 HIGH
7.8 Apr 13

Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vu
CVE-2021-28321 HIGH
7.8 Apr 13

Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vu
CVE-2021-28313 HIGH
7.8 Apr 13

Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vu
CVE-2021-1680 HIGH
7.8 Jan 12

Diagnostics Hub Standard Collector Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerabil
CVE-2021-1651 HIGH
7.8 Jan 12

Diagnostics Hub Standard Collector Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerabil
CVE-2020-16874 HIGH
7.8 Sep 11

<p>A remote code execution vulnerability exists in Visual Studio when it improperly handles objects in memory. Rated hig

Same weakness CWE-59 – Improper Link Resolution Before File Access

View all
CVE-2020-0787 HIGH POC
7.8
CVE-2015-1130 HIGH POC
7.8
CVE-2015-5287 HIGH POC
7.8
CVE-2026-41091 HIGH POC
7.8
CVE-2019-1069 HIGH POC
7.8
CVE-2026-81963 HIGH POC
7.8
CVE-2016-6664 HIGH POC
7.0
CVE-2025-60710 HIGH POC
7.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2025-49739 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy