The flaw involves incorrect privilege assignment in Visual Studio Code, allowing an attacker who already has authorized local access to bypass a security feature. This bypass can let the user modify settings or files that are normally restricted within the editor, effectively elevating their capabilities locally.

Microsoft Visual Studio Code – all installed versions are affected; specific version ranges are not disclosed.

The vulnerability has a CVSS score of 6.1, indicating moderate severity. The attack vector requires local authorized access and there is no evidence of remote exploitation. EPSS data is not available and the issue is not listed in CISA KEV, so widespread exploitation risk is unclear, but timely remediation is advised.