The vulnerability is a protection mechanism failure in Microsoft Visual Studio that allows an unauthorized attacker to execute code locally. An attacker who can compromise a development machine or insert malicious content into a project can trigger the flaw and run arbitrary code with the permissions of the user. The scenario where an attacker can compromise a development machine or insert malicious content into a project to trigger the flaw is inferred from the description and not explicitly stated. The weakness is identified as CWE‑693, indicating that the software failed to enforce necessary security safeguards. The potential impact is that a local attacker could alter or delete project files, inject malware into builds, or take full control of the affected workstation.

Affected installations include Microsoft Visual Studio 2022 versions 17.12 and 17.14, and Microsoft Visual Studio 2026 version 18.7. The problem exists across both the 2022 and 2026 product lines, meaning users of these specific releases are vulnerable until patched. No other versions were listed as affected, so workstations running newer releases are not known to be impacted. The patching solution or version that fixes the issue is not stated directly; users should consult the Microsoft advisory for the latest update.

The CVSS score is 7.8, reflecting a high severity. The EPSS score is under 1 %, indicating a very low probability of exploitation at the time of this analysis. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no active exploits are reported. The likely attack vector appears to be local, but this is inferred from the description. It requires the attacker to have access to the development environment or to trick a developer into opening a malicious project. Because of this local nature and the low EPSS, the risk is considered high severity but low current likelihood, especially for organizations that enforce strict access controls and code signing.