Visual Studio Code EUVD-2026-100602

Exploitation requires that the victim running Visual Studio Code (versions 1.0.0 up to but not including 1.141.1) open or interact with attacker-controlled content, because the CVSS vector specifies UI:R - this user-interaction requirement is the primary limiting factor and means it cannot be triggered fully passively. No authentication is required (PR:N), and the attack is network-delivered (AV:N) with low complexity (AC:L), so no special privileges or local access are needed once the user interacts. The specific security feature being bypassed and the exact untrusted input channel (CWE-807, reliance on untrusted inputs in a security decision) are not named in the available description and should be confirmed via the MSRC advisory to identify any configuration or feature prerequisites.

This is a moderate-priority issue, not a top-tier emergency, despite a CVSS of 7.4. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N) indicates a network-reachable, low-complexity, unauthenticated security-feature bypass that yields high confidentiality impact with a scope change, but it is gated by required user interaction (UI:R) - the victim developer must open or interact with attacker-controlled content. No EPSS probability is provided in the input and the CVE is NOT on CISA KEV, so there is no public evidence of active exploitation; exploitation status is 'no public exploit identified at time of analysis.' No POC is referenced. Signals are therefore largely consistent: a real but not widespread/automated threat - serious given VS Code's huge developer install base, but mitigated by the UI requirement and the absence of exploitation or exploit-code evidence. Key limitation: the description is terse ('reliance on untrusted inputs in a security decision') and does not name the specific security feature bypassed, so the concrete real-world impact (what trust boundary is defeated) cannot be fully confirmed from available data and should be verified against the MSRC advisory.

An attacker crafts malicious content (e.g., a repository, workspace, file, or web resource) that supplies untrusted input into a trust/security decision made by VS Code. When the developer opens or interacts with it (UI:R), the editor bypasses the intended security control, allowing the attacker to access protected information across a trust boundary (S:C, C:H). No public exploit code is identified at time of analysis.