CVE-2020-16874: Visual Studio Remote Code Execution Vulnerability
First published: Fri Sep 11 2020(Updated: )
<p>A remote code execution vulnerability exists in Visual Studio when it improperly handles objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.</p> <p>To exploit the vulnerability, an attacker would have to convince a user to open a specially crafted file with an affected version of Visual Studio.</p> <p>The update addresses the vulnerability by correcting how Visual Studio handles objects in memory.</p>
Credit: secure@microsoft.com secure@microsoft.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| =2012-update_5 | ||
| =2013-update_5 | ||
| =2015-update_3 | ||
| >=15.0<=15.8 | ||
| >=16.0<=16.3 | ||
| >=16.5<=16.6 | ||
| Microsoft Visual Studio | =2012-update_5 | |
| Microsoft Visual Studio | =2013-update_5 | |
| Microsoft Visual Studio | =2015-update_3 | |
| Microsoft Visual Studio 2017 | >=15.0<=15.8 | |
| Microsoft Visual Studio 2019 | >=16.0<=16.3 | |
| Microsoft Visual Studio 2019 | >=16.5<=16.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2020-16874?
CVE-2020-16874 is a remote code execution vulnerability in Visual Studio.
How does CVE-2020-16874 impact Visual Studio?
CVE-2020-16874 can allow an attacker to execute arbitrary code on a vulnerable Visual Studio installation.
Which versions of Visual Studio are affected by CVE-2020-16874?
CVE-2020-16874 affects Microsoft Visual Studio 2012 Update 5, Microsoft Visual Studio 2013 Update 5, Microsoft Visual Studio 2015 Update 3, Microsoft Visual Studio 2017 (version 15.0 to 15.8), and Microsoft Visual Studio 2019 (version 16.0 to 16.3).
What is the severity of CVE-2020-16874?
CVE-2020-16874 has a severity rating of 7.8 (Critical).
How can I fix CVE-2020-16874 in Visual Studio?
To fix CVE-2020-16874, users should update their affected Visual Studio installations to the latest available version.
- collector/nvd-index
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- agent/author
- agent/softwarecombine
- agent/description
- agent/remedy
- agent/references
- agent/title
- agent/severity
- agent/event
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/microsoft
- canonical/microsoft visual studio
- version/microsoft visual studio/2012-update_5
- version/microsoft visual studio/2013-update_5
- version/microsoft visual studio/2015-update_3
- canonical/microsoft visual studio 2017
- version/microsoft visual studio 2017/15.0
- version/microsoft visual studio 2017/15.8
- canonical/microsoft visual studio 2019
- version/microsoft visual studio 2019/16.0
- version/microsoft visual studio 2019/16.3
- version/microsoft visual studio 2019/16.5
- version/microsoft visual studio 2019/16.6