Visual Studio Code EUVD-2026-99038

Exploitation requires local delivery of attacker-controlled content (AV:L) and the victim must actively interact with it - typically opening a crafted workspace, folder, or file in Visual Studio Code (UI:R). No pre-existing privileges or authentication are required (PR:N), and attack complexity is low (AC:L), so once the user opens the malicious content the missing authorization check is bypassed without further conditions. The primary limiting factors are the need for local access and mandatory user interaction, which prevent remote, unattended, or automated mass exploitation; impact is confined to the interacting user's context (S:U). The exact security feature being bypassed is not detailed in the available data and should be confirmed against the Microsoft MSRC advisory.

This is a locally-exploitable missing-authorization flaw (CWE-862) in Visual Studio Code with a CVSS 3.1 base score of 7.8. The vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates the attacker needs local access and user interaction, but no prior privileges, and achieves full confidentiality, integrity, and availability impact once triggered - consistent with code execution or a security-feature bypass in the context of the victim user. No EPSS score, CISA KEV listing, POC reference, or SSVC decision data was supplied, so exploitation status is: no public exploit identified at time of analysis. The combination of AV:L and UI:R materially lowers real-world risk relative to the 7.8 score: this is not a remotely wormable, mass-exploitable bug but one requiring the target to open or interact with attacker-controlled content on their own machine. PR:N despite being an authorization bypass is coherent - the flaw itself is the missing access control the attacker abuses, so no credentials are needed. Note a terminology tension: the single tag labels this an 'Authentication Bypass,' whereas CWE-862 and the description ('bypass a security feature') describe an authorization/security-feature bypass - verify intent with Microsoft's advisory. Overall this is a moderate, user-interaction-gated local issue rather than an urgent internet-facing emergency, but given VS Code's enormous install base it still warrants prompt patching.

An attacker crafts a malicious VS Code workspace, project folder, or file and delivers it to a developer (e.g., via a repository, archive, or shared project). When the victim opens it locally, the missing authorization check lets the content bypass an intended security control and run with the victim's privileges, yielding high confidentiality, integrity, and availability impact. No public exploit code was identified in the provided data.