The vulnerability arises from improper resolution of path equivalence in Visual Studio Code, allowing an unauthorized local attacker to bypass a built‑in security feature. This weakness, identified as CWE‑41, permits the attacker to use alternative path representations to trick the application into treating a restricted location as permissible. The resulting impact is that the local user can gain unauthorized access to protected resources or actions within the editor environment.

This flaw affects Microsoft Visual Studio Code. Vendor information is provided, but the CVE data does not list specific affected versions, so all installations of VS Code are potentially vulnerable until a patch is applied if the issue is present in newer releases. The absence of targeted version details means administrators should err on the side of caution and upgrade whatever version they run.

The CVSS score of 7.7 indicates a high severity for a local vulnerability. No EPSS value is available, so the likelihood of exploitation cannot be quantified. The flaw is not listed in the CISA KEV catalog. The attack vector is inferred to be local, requiring an attacker who already has access to the target machine. Once exploited, the bypass could allow the attacker to execute privileged actions or read sensitive configuration files that would normally be protected by the editor's security controls.