CVE-2025-24998 Uncontrolled search path element in Visual Studio allows an authorized attacker to elevate privileges locally

Description

Uncontrolled search path element in Visual Studio allows an authorized attacker to elevate privileges locally.

Affected products and versions

Product	Affected versions	Fixed in
Microsoft Visual Studio 2022 version 17.13 17.13	17.13.0 → < 17.13.3	17.13.3
Microsoft Visual Studio 2022 version 17.12 17.12	17.12.0 → < 17.12.6	17.12.6
Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) 15.9	15.9.0 → < 15.9.71	15.9.71
Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) 16.11	16.11.0 → < 16.11.45	16.11.45
Microsoft Visual Studio 2022 version 17.8 17.8	17.8.0 → < 17.8.19	17.8.19
Microsoft Visual Studio 2022 version 17.10 17.10	17.10.0 → < 17.10.12	17.10.12

Other CVEs of Microsoft Visual Studio 2022 version 17.13

The 8 CVEs of Microsoft Visual Studio 2022 version 17.13 →

CVE-2025-26646 External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized… 8.0 High CVE-2025-32702 Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an… 7.8 High CVE-2025-32703 Insufficient granularity of access control in Visual Studio allows an authorized attacker to disclose information… 5.5 Medium CVE-2025-26682 Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service… 7.5 High