The vulnerability in Visual Studio Code arises from an incorrect authorization check that allows an attacker with local access to bypass a built‑in security feature. This flaw is mapped to CWE‑863, indicating an authorization bypass through user‑controlled input. The bug does not enable remote code execution or network exploitation; instead, it lets any user who can launch Visual Studio Code locally perform actions normally restricted by the feature, potentially exposing sensitive data or disabling protective safeguards.

Microsoft Visual Studio Code is affected. No specific version is identified in the advisory, meaning that any installation lacking the latest update that contains the authorization fix could be vulnerable.

The CVSS base score of 7 suggests medium to high risk. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation. Because the attack vector is local, the risk is confined to users who have or can obtain local access to the target machine. Prompt application of the vendor‑issued update will mitigate the issue.