Microsoft Visual Studio Improper Access Control Vulnerability Allowing Privilege Escalation

A vulnerability exists in Microsoft Visual Studio due to improper access control, which allows an authorized attacker to locally elevate privileges. This issue affects multiple versions of Visual Studio 2022, as well as Visual Studio 2019 and 2017. An authenticated attacker could exploit this vulnerability by placing a malicious file in the project directory path, waiting for a user with administrative rights to create a project, and thereby gaining elevated privileges.

Impact

Exploitation of this vulnerability could lead to unauthorized administrative privileges.

Remediation

Users can download the security update for Microsoft Visual Studio 2022 versions 17.10, 17.12, and 17.14, as well as for Visual Studio 2019 version 16.11 and Visual Studio 2017 version 15.9, through the Visual Studio Download Center.