Vulnerability DatabaseCVE-2025-32702

CVE-2025-32702:
vulnerability analysis and mitigation

Overview

CVE-2025-32702 is a command injection vulnerability in Microsoft Visual Studio that allows an unauthorized attacker to execute code locally. The vulnerability was discovered and disclosed on May 13, 2025, affecting multiple versions of Visual Studio 2019 and 2022. Microsoft has confirmed this as a zero-day vulnerability with evidence of public disclosure (Rapid7 Blog, NVD).

Technical details

The vulnerability is classified as an improper neutralization of special elements used in a command (command injection) with a CVSSv3.1 base score of 7.8 HIGH (Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation requires the user to download and open a malicious file. The affected versions include Visual Studio 2019 (versions 16.0 to 16.11.47) and Visual Studio 2022 (versions 17.8.0 to 17.8.21, 17.10.0 to 17.10.14, 17.12.0 to 17.12.8, and 17.13.0 to 17.13.7) (NVD).

Impact

Successful exploitation of this vulnerability allows an unauthorized attacker to execute code locally on the affected system, potentially leading to complete compromise of the local machine where Visual Studio is installed (NVD).

Mitigation and workarounds

Microsoft has released security patches for all affected versions of Visual Studio. Users are strongly advised to update to the latest versions: Visual Studio 2019 version 16.11.47 or later, and Visual Studio 2022 versions 17.8.21, 17.10.14, 17.12.8, or 17.13.7 or later (NVD).