CVE-2019-0537
CVE-2019-0537 is a medium-severity vulnerability in Microsoft Visual Studio with a CVSS 3.x base score of 5.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.
Key facts
- Severity: Medium (CVSS 3.x base score 5.5)
- CVSS v2: 4.3
- EPSS exploit prediction: 8% (94th percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: Microsoft Visual Studio
- Published:
- Last modified:
Description
An information disclosure vulnerability exists when Visual Studio improperly discloses arbitrary file contents if the victim opens a malicious .vscontent file, aka "Microsoft Visual Studio Information Disclosure Vulnerability." This affects Microsoft Visual Studio.
Frequently asked questions
- What is CVE-2019-0537?
- An information disclosure vulnerability exists when Visual Studio improperly discloses arbitrary file contents if the victim opens a malicious .vscontent file, aka "Microsoft Visual Studio Information Disclosure Vulnerability." This affects Microsoft Visual Studio.
- How severe is CVE-2019-0537?
- CVE-2019-0537 has a CVSS 3.x base score of 5.5, rated medium severity. It is exploitable over local access with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity none, and availability none.
- Is CVE-2019-0537 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 8% (94th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2019-0537?
- CVE-2019-0537 primarily affects Microsoft Visual Studio. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2019-0537?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2019-0537 published?
- CVE-2019-0537 was published on 2019-01-08 and last updated on 2026-06-17.
References
- http://www.securityfocus.com/bid/106390
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0537
Affected products (2)
- cpe:2.3:a:microsoft:visual_studio:2010:sp1:*:*:*:*:*:*
- cpe:2.3:a:microsoft:visual_studio:2012:update_5:*:*:*:*:*:*
More vulnerabilities in Microsoft Visual Studio
- CVE-2009-3126 — Critical (CVSS 9.3): Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3,…
- CVE-2009-2528 — Critical (CVSS 9.3): GDI+ in Microsoft Office XP SP3 does not properly handle malformed objects in Office Art Property Tables, which allows…
- CVE-2009-2504 — Critical (CVSS 9.3): Multiple integer overflows in unspecified APIs in GDI+ in Microsoft .NET Framework 1.1 SP1, .NET Framework 2.0 SP1 and…
- CVE-2009-2503 — Critical (CVSS 9.3): GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Windows Server 2003 SP2, Office XP SP3, Office 2003…
- CVE-2009-2501 — Critical (CVSS 9.3): Heap-based buffer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office…
- CVE-2009-2500 — Critical (CVSS 9.3): Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3,…