CVE-2020-16856: Visual Studio Remote Code Execution Vulnerability
First published: Fri Sep 11 2020(Updated: )
<p>A remote code execution vulnerability exists in Visual Studio when it improperly handles objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.</p> <p>To exploit the vulnerability, an attacker would have to convince a user to open a specially crafted file with an affected version of Visual Studio.</p> <p>The update addresses the vulnerability by correcting how Visual Studio handles objects in memory.</p>
Credit: secure@microsoft.com secure@microsoft.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| =2012-update_5 | ||
| =2013-update_5 | ||
| =2015-update_3 | ||
| >=15.0<=15.8 | ||
| >=16.0<=16.3 | ||
| >=16.5<=16.6 | ||
| Microsoft Visual Studio | =2012-update_5 | |
| Microsoft Visual Studio | =2013-update_5 | |
| Microsoft Visual Studio | =2015-update_3 | |
| Microsoft Visual Studio 2017 | >=15.0<=15.8 | |
| Microsoft Visual Studio 2019 | >=16.0<=16.3 | |
| Microsoft Visual Studio 2019 | >=16.5<=16.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2020-16856?
The severity of CVE-2020-16856 is critical with a severity value of 7.8.
Which software versions are affected by CVE-2020-16856?
The affected software versions are Microsoft Visual Studio 2012 (update 5), Visual Studio 2013 (update 5), Visual Studio 2015 (update 3), Visual Studio 2017 (versions 15.0 to 15.8), and Visual Studio 2019 (versions 16.0 to 16.3 and 16.5 to 16.6).
What is the description of CVE-2020-16856?
CVE-2020-16856 is a remote code execution vulnerability in Visual Studio that occurs when it improperly handles objects in memory.
How can I fix CVE-2020-16856?
To fix CVE-2020-16856, it is recommended to install the latest security updates provided by Microsoft for the affected versions of Visual Studio.
Where can I find more information about CVE-2020-16856?
You can find more information about CVE-2020-16856 on the Microsoft Security Response Center website.
- collector/nvd-index
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- agent/author
- agent/softwarecombine
- agent/description
- agent/references
- agent/severity
- agent/title
- agent/remedy
- agent/event
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/microsoft
- canonical/microsoft visual studio
- version/microsoft visual studio/2012-update_5
- version/microsoft visual studio/2013-update_5
- version/microsoft visual studio/2015-update_3
- canonical/microsoft visual studio 2017
- version/microsoft visual studio 2017/15.0
- version/microsoft visual studio 2017/15.8
- canonical/microsoft visual studio 2019
- version/microsoft visual studio 2019/16.0
- version/microsoft visual studio 2019/16.3
- version/microsoft visual studio 2019/16.5
- version/microsoft visual studio 2019/16.6