CVE-2025-25003: Visual Studio Elevation of Privilege Vulnerability
Published Mar 11, 2025
·Updated
Uncontrolled search path element in Visual Studio allows an authorized attacker to elevate privileges locally.
Other sources
Visual Studio Elevation of Privilege Vulnerability
— Microsoft
Affected Software
9 affected componentsFixes available
Microsoft Visual Studio 2019 (includes 16.0 - 16.10)=16.11
Microsoft Visual Studio 2022=17.10
Microsoft Visual Studio 2022=17.13
Microsoft Visual Studio 2022=17.8
Microsoft Visual Studio 2019>=16.0<16.11.45
Microsoft Visual Studio 2022>=17.8.0<17.8.19
Microsoft Visual Studio 2022>=17.10.0<17.10.12
Microsoft Visual Studio 2022>=17.12.0<17.12.6
Microsoft Visual Studio 2022>=17.13.0<17.13.3
Event History
Mar 11, 2025
CVE Published
via Microsoft·07:00 AM
Data Sourced
via Microsoft·07:00 AM
DescriptionSeverityWeakness
CVE Published
via MITRE·04:59 PM
Data Sourced
via MITRE·04:59 PM
DescriptionSeverity
Data Sourced
via NVD·05:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-25003?
The severity of CVE-2025-25003 is classified as important, indicating a significant potential for privilege escalation.
2
How do I fix CVE-2025-25003?
To fix CVE-2025-25003, users should update their Visual Studio to the latest patched version as recommended by Microsoft.
3
Which products are affected by CVE-2025-25003?
CVE-2025-25003 affects Visual Studio 2019 version 16.11 and Visual Studio 2022 versions 17.8, 17.10, and 17.13.
4
What type of vulnerability is CVE-2025-25003?
CVE-2025-25003 is classified as an elevation of privilege vulnerability due to an uncontrolled search path element.
5
Can CVE-2025-25003 be exploited remotely?
No, CVE-2025-25003 requires local access to the machine, making it a local privilege escalation vulnerability.