Microsoft Diagnostics Runtime
Monthly
Privilege elevation in Microsoft Visual Studio 2022 (17.14.0 to <17.14.40), Visual Studio 2026 (18.9.0 to <18.9.3), and the Microsoft.Diagnostics.Runtime (ClrMD) library stems from external control of a file name or path (CWE-73) that a higher-privileged process then resolves without canonicalization, letting an unauthenticated remote attacker influence which file is opened or executed and thereby gain the privileges of the resolving process. The assessed vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, CVSS 8.1) confirms no authentication or user interaction is required, but the high attack-complexity rating reflects that success depends on specific input conditions and on whether the affected developer/diagnostics component actually consumes attacker-influenced paths in a given deployment. Risk signals are mixed: EPSS is only 0.51% (42nd percentile), CISA SSVC records Exploitation: none and Automatable: no, and no public exploit code has been identified at time of analysis, so this is a high-severity but not high-urgency issue; vendor patches are available and the affected components are developer tooling rather than always-on network services.
Privilege elevation in Microsoft Visual Studio 2022 (17.14.0 to <17.14.40), Visual Studio 2026 (18.9.0 to <18.9.3), and the Microsoft.Diagnostics.Runtime (ClrMD) library stems from external control of a file name or path (CWE-73) that a higher-privileged process then resolves without canonicalization, letting an unauthenticated remote attacker influence which file is opened or executed and thereby gain the privileges of the resolving process. The assessed vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, CVSS 8.1) confirms no authentication or user interaction is required, but the high attack-complexity rating reflects that success depends on specific input conditions and on whether the affected developer/diagnostics component actually consumes attacker-influenced paths in a given deployment. Risk signals are mixed: EPSS is only 0.51% (42nd percentile), CISA SSVC records Exploitation: none and Automatable: no, and no public exploit code has been identified at time of analysis, so this is a high-severity but not high-urgency issue; vendor patches are available and the affected components are developer tooling rather than always-on network services.