CVE-2026-102851: Visual Studio Code Security Feature Bypass Vulnerability
Incorrect privilege assignment in Visual Studio Code allows an authorized attacker to bypass a security feature locally.
Other sources
Visual Studio Code Security Feature Bypass Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.141.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running Microsoft Visual Studio Code are potentially exposed when an authorized local attacker can interact with the application. The available information does not identify specific affected versions or configurations.
What access and conditions are required for exploitation?
An attacker needs authorized local access and low privileges. Exploitation also requires user interaction and has high attack complexity, so it is not described as a remote or unauthenticated attack.
What is the potential impact?
Successful exploitation allows a security feature bypass caused by incorrect privilege assignment. The published metrics indicate low confidentiality impact and high integrity impact, with no availability impact.