CVE-2025-49739: Visual Studio Elevation of Privilege Vulnerability
Published Jul 8, 2025
·Updated
Improper link resolution before file access ('link following') in Visual Studio allows an unauthorized attacker to elevate privileges over a network.
Other sources
Visual Studio Elevation of Privilege Vulnerability
— Microsoft
Affected Software
13 affected componentsFixes available
Microsoft Visual Studio 2015=3
Microsoft Visual Studio 2022=17.14
Microsoft Visual Studio 2022=17.8
Microsoft Visual Studio 2019 (includes 16.0 - 16.10)=16.11
Microsoft Visual Studio 2017 (includes 15.0 - 15.8)=15.9
Microsoft Visual Studio 2022=17.12
Microsoft Visual Studio=2015-update3
Microsoft Visual Studio 2017>=15.0<15.9.75
Microsoft Visual Studio 2019>=16.0<16.11.49
Microsoft Visual Studio 2022>=17.8.0<17.8.23
Microsoft Visual Studio 2022>=17.10.0<17.10.17
Microsoft Visual Studio 2022>=17.12.0<17.12.10
Microsoft Visual Studio 2022>=17.14.0<17.14.8
Event History
Jul 8, 2025
CVE Published
via Microsoft·07:00 AM
Data Sourced
via Microsoft·07:00 AM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·07:00 AM
Affected Software
Updated
via Microsoft·07:00 AM
Description
Updated
via Microsoft·07:00 AM
Affected Software
CVE Published
via MITRE·04:58 PM
Data Sourced
via MITRE·04:58 PM
DescriptionSeverity
Data Sourced
via NVD·05:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-49739?
CVE-2025-49739 has a critical severity rating due to its potential to allow unauthorized privilege escalation.
2
How do I fix CVE-2025-49739?
To fix CVE-2025-49739, apply the security patches available for the affected versions of Visual Studio.
3
Which versions of Visual Studio are affected by CVE-2025-49739?
CVE-2025-49739 affects Visual Studio 2015, 2017, 2019, and 2022.
4
What type of vulnerability is CVE-2025-49739?
CVE-2025-49739 is classified as an improper link resolution vulnerability that can be exploited before file access.
5
Who can be impacted by CVE-2025-49739?
Developers and organizations using the vulnerable versions of Visual Studio can be impacted by CVE-2025-49739.