Visual Studio Code EUVD-2026-100323

Exploitation requires the attacker to already be a locally authorized user on the same host as the victim (AV:L, PR:L) - this is not remotely reachable. The attacker must also satisfy a high-complexity precondition (AC:H), such as a race or specific environmental state, and the victim must perform an in-editor action (UI:R). These limiting factors - local access, existing authorization, a difficult-to-control condition, and required user interaction - substantially constrain real-world exploitation despite the scope-changed integrity impact. The exact security feature bypassed and the precise triggering workflow are not detailed in the available data (only the MSRC advisory is referenced); verify specifics against the Microsoft update guide for CVE-2026-102851.

This is a moderate-severity, local privilege/security-feature bypass that should be treated as a routine patch priority rather than an emergency. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N, base 6.1) describes a difficult-to-exploit local issue: the attacker must already be a locally authorized user (PR:L), must win a high-complexity condition (AC:H), and must induce user interaction (UI:R). The scope change (S:C) and high integrity impact (I:H) explain why the score is not lower despite the local vector - a successful bypass can affect resources beyond the vulnerable component's security authority. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation. The combination of local-only access, high attack complexity, required privileges, and required user interaction makes mass exploitation unlikely; the realistic concern is a motivated local actor on a shared or multi-user developer workstation. Net: a real but low-urgency fix given the enormous install base of VS Code, worth rolling out in normal patch cycles.

A locally authorized user on a shared developer machine crafts a malicious workspace or project artifact and, by winning a timing/condition-dependent race (AC:H) and getting the victim to perform an action in the editor (UI:R), causes VS Code to misassign privileges and bypass a security feature. No public exploit code is known, and the high attack complexity plus required user interaction make reliable exploitation difficult.