Vulnerability DatabaseCVE-2025-32703

CVE-2025-32703:
vulnerability analysis and mitigation

Overview

CVE-2025-32703 is an information disclosure vulnerability affecting Microsoft Visual Studio, disclosed on May 13, 2025. The vulnerability stems from insufficient granularity of access control in Visual Studio that enables authorized attackers to disclose information locally. The affected systems include multiple versions of Visual Studio: Visual Studio 2017 (versions 15.0 to 15.9.73), Visual Studio 2019 (versions 16.0 to 16.11.47), and Visual Studio 2022 (various version ranges including 17.8.0 to 17.8.21, 17.10.0 to 17.10.14, 17.12.0 to 17.12.8, and 17.13.0 to 17.13.7) (NVD).

Technical details

The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The vulnerability is associated with two Common Weakness Enumeration (CWE) categories: CWE-1220 (Insufficient Granularity of Access Control) and CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) (NVD, Wiz).

Impact

The vulnerability allows an authorized attacker to disclose information locally. According to the CVSS scoring, while the vulnerability has a high confidentiality impact, it does not affect the integrity or availability of the system (Wiz).

Mitigation and workarounds

Microsoft has addressed this vulnerability as part of their May 2025 Patch Tuesday security updates. Users are advised to apply the latest security updates to their Visual Studio installations (Wiz).