The vulnerability arises from the MSSQL Extension for Visual Studio Code including functionality that originates from an untrusted control sphere, allowing an unauthorized attacker to elevate their privileges locally. This elevation can enable the attacker to execute arbitrary code or make unauthorized modifications within the user’s environment, representing a significant compromise of system integrity. The weakness aligns with CWE-829 and CWE-94, indicating improper control usage and potential code injection mechanisms.

Microsoft Visual Studio Code MSSQL Extension is affected. No specific version range is provided, so all installations using this extension are potentially vulnerable until a fix is applied.

The CVSS score of 7.8 classifies the issue as high severity, and although the EPSS score is not available, the lack of listing in the CISA KEV catalog means no publicly disclosed active exploitation has been reported. The likely attack vector is provided by the extension’s ability to execute code, inferred to require the extension to be installed and run within the Visual Studio Code environment. In the absence of exploitation data, the risk remains high, especially for systems that rely on the MSSQL Extension without additional access controls.