The vulnerability arises from improper input validation within Visual Studio Code, permitting an attacker lacking authorization to gain elevated privileges over a network connection. This flaw is classified as input validation failure, aligning with CWE-20. Because the attacker can exploit this to elevate privileges, the potential impact includes unauthorized data access, configuration changes, or execution of further malicious actions with higher privileges. The scope extends across any user interacting with the affected software over the network.

The flaw affects Microsoft Visual Studio Code. Specific version information was not provided, so the issue may be present across multiple releases until patched. All installations that expose VS Code to network traffic are potentially vulnerable.

The CVSS score of 7.5 indicates a high severity of the flaw. The EPSS score is not available, so the current exploitation probability cannot be quantified. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the attacker must be able to interact with VS Code over a network, suggesting the attack vector is likely network-based. No additional prerequisites were specified, implying that any remote user who can send crafted input to VS Code may be able to exploit the flaw.