The vulnerability in Visual Studio Code allows an unauthorized actor to read sensitive information that the editor may have in memory or send over the network. The flaw is classified as an information disclosure risk, as described by CWE-200. The impact is that confidential code, files or configuration data could leak to an observer of the network traffic or local connection, potentially exposing intellectual property or credentials.

Microsoft Visual Studio Code is affected. No specific version range is listed in the CNA data, so all installed instances of Visual Studio Code that have not yet applied Microsoft’s hotfix are potentially vulnerable. Checking the Microsoft Security Response Center or the update guide linked in the references will provide the exact version numbers requiring the update.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score is < 1%, indicating a low likelihood of exploitation. The vulnerability is not tracked in the CISA KEV catalog, suggesting that no widespread exploitation is confirmed yet. Based on the description, the likely attack vector is a network connection used by VS Code – for example, a local or remote debugging session – that could expose sensitive data if the connection is not properly protected. An attacker who can reach the VS Code process over the network could exploit the flaw and capture the disclosed information.