Visual Studio Code incorporates functionality from an untrusted control sphere, allowing an attacker to bypass a built‑in security feature over a network. The flaw falls under CWE‑200 (Information Exposure) and CWE‑829 (Unauthorized Modification of Resources). This bypass can lead to unauthorized disclosure of sensitive data or manipulation of the editor’s behavior, but it does not provide direct code execution or denial of service capabilities.

The vulnerability affects Microsoft Visual Studio Code on all platforms where the impacted code path is present. No specific version information is disclosed in the advisory; all users should ensure they are running a version that includes the Microsoft fix referenced in the Microsoft Security Response Center advisory.

The CVSS score of 8.8 indicates high severity, yet the EPSS score of less than 1% signals a very low probability of exploitation in the wild. The issue is not currently listed in the CISA KEV catalog, and no public exploits have been reported. The likely attack vector is remote input over a network; an attacker would need to deliver specially crafted traffic to a running instance of Visual Studio Code to exploit the control‑flow bypass. Due to the low exploitation probability, the overall risk remains primarily governed by the high potential impact if the vulnerability is successfully abused.