Microsoft Visual Studio 2017 — known CVE vulnerabilities

Every CVE whose affected-product data names Microsoft Visual Studio 2017, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (92)

• CVE-2025-21178 — CVSS 8.8 (high): Visual Studio Remote Code Execution Vulnerability
• CVE-2019-1350 — CVSS 8.8 (high): A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code…
• CVE-2022-35826 — CVSS 8.8 (high): Visual Studio Remote Code Execution Vulnerability
• CVE-2019-1352 — CVSS 8.8 (high): A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code…
• CVE-2019-1354 — CVSS 8.8 (high): A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code…
• CVE-2022-35825 — CVSS 8.8 (high): Visual Studio Remote Code Execution Vulnerability
• CVE-2025-49739 — CVSS 8.8 (high): Improper link resolution before file access ('link following') in Visual Studio allows an unauthorized attacker to elevate privileges over…
• CVE-2025-21176 — CVSS 8.8 (high): .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
• CVE-2022-35777 — CVSS 8.8 (high): Visual Studio Remote Code Execution Vulnerability
• CVE-2020-1416 — CVSS 8.8 (high): An elevation of privilege vulnerability exists in Visual Studio and Visual Studio Code when they load software dependencies, aka 'Visual…
• CVE-2019-0613 — CVSS 8.8 (high): A remote code execution vulnerability exists in .NET Framework and Visual Studio software when the software fails to check the source…
• CVE-2019-1349 — CVSS 8.8 (high): A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code…
• CVE-2019-1113 — CVSS 8.8 (high): A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who…
• CVE-2022-35827 — CVSS 8.8 (high): Visual Studio Remote Code Execution Vulnerability
• CVE-2023-36897 — CVSS 8.1 (high): Visual Studio Tools for Office Runtime Spoofing Vulnerability
• CVE-2023-21815 — CVSS 7.8 (high): Visual Studio Remote Code Execution Vulnerability
• CVE-2018-8172 — CVSS 7.8 (high): A remote code execution vulnerability exists in Visual Studio software when the software does not check the source markup of a file for an…
• CVE-2018-8232 — CVSS 7.8 (high): A Tampering vulnerability exists when Microsoft Macro Assembler improperly validates code, aka "Microsoft Macro Assembler Tampering…
• CVE-2018-8599 — CVSS 7.8 (high): An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector Service improperly impersonates certain file…
• CVE-2019-0546 — CVSS 7.8 (high): A remote code execution vulnerability exists in Visual Studio when the C++ compiler improperly handles specific combinations of C++…
• CVE-2019-0727 — CVSS 7.8 (high): An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector or the Visual Studio Standard Collector allows…
• CVE-2019-0809 — CVSS 7.8 (high): A remote code execution vulnerability exists when the Visual Studio C++ Redistributable Installer improperly validates input before loading…
• CVE-2019-1232 — CVSS 7.8 (high): An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector Service improperly impersonates certain file…
• CVE-2020-0793 — CVSS 7.8 (high): An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector Service improperly handles file operations, aka…
• CVE-2020-0810 — CVSS 7.8 (high): An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector or the Visual Studio Standard Collector allows…
• CVE-2020-1147 — CVSS 7.8 (high) — actively exploited: A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check…
• CVE-2020-1202 — CVSS 7.8 (high): An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector or the Visual Studio Standard Collector fail to…
• CVE-2020-1203 — CVSS 7.8 (high): An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector or the Visual Studio Standard Collector fail to…
• CVE-2020-1257 — CVSS 7.8 (high): An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector Service improperly handles file operations, aka…
• CVE-2020-1278 — CVSS 7.8 (high): An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector Service improperly handles file operations, aka…
• CVE-2020-1293 — CVSS 7.8 (high): An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector Service improperly handles file operations, aka…
• CVE-2020-1393 — CVSS 7.8 (high): An elevation of privilege vulnerability exists when the Windows Diagnostics Hub Standard Collector Service fails to properly sanitize…
• CVE-2020-16856 — CVSS 7.8 (high): <p>A remote code execution vulnerability exists in Visual Studio when it improperly handles objects in memory. An attacker who successfully…
• CVE-2020-16874 — CVSS 7.8 (high): <p>A remote code execution vulnerability exists in Visual Studio when it improperly handles objects in memory. An attacker who successfully…
• CVE-2020-17156 — CVSS 7.8 (high): Visual Studio Remote Code Execution Vulnerability
• CVE-2021-1651 — CVSS 7.8 (high): Diagnostics Hub Standard Collector Elevation of Privilege Vulnerability
• CVE-2021-1680 — CVSS 7.8 (high): Diagnostics Hub Standard Collector Elevation of Privilege Vulnerability
• CVE-2021-26434 — CVSS 7.8 (high): Visual Studio Elevation of Privilege Vulnerability
• CVE-2021-27064 — CVSS 7.8 (high): Visual Studio Installer Elevation of Privilege Vulnerability
• CVE-2021-28313 — CVSS 7.8 (high): Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability
• CVE-2021-28321 — CVSS 7.8 (high): Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability
• CVE-2021-28322 — CVSS 7.8 (high): Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability
• CVE-2021-36952 — CVSS 7.8 (high): Visual Studio Remote Code Execution Vulnerability
• CVE-2022-24767 — CVSS 7.8 (high): GitHub: Git for Windows' uninstaller vulnerable to DLL hijacking when run under the SYSTEM user account.
• CVE-2022-29148 — CVSS 7.8 (high): Visual Studio Remote Code Execution Vulnerability
• CVE-2022-41119 — CVSS 7.8 (high): Visual Studio Remote Code Execution Vulnerability
• CVE-2023-21566 — CVSS 7.8 (high): Visual Studio Elevation of Privilege Vulnerability
• CVE-2023-21808 — CVSS 7.8 (high): .NET and Visual Studio Remote Code Execution Vulnerability
• CVE-2018-0952 — CVSS 7.8 (high): An Elevation of Privilege vulnerability exists when Diagnostics Hub Standard Collector allows file creation in arbitrary locations, aka…
• CVE-2023-23381 — CVSS 7.8 (high): Visual Studio Remote Code Execution Vulnerability
• CVE-2023-24897 — CVSS 7.8 (high): .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
• CVE-2023-28296 — CVSS 7.8 (high): Visual Studio Remote Code Execution Vulnerability
• CVE-2023-36792 — CVSS 7.8 (high): Visual Studio Remote Code Execution Vulnerability
• CVE-2023-36793 — CVSS 7.8 (high): Visual Studio Remote Code Execution Vulnerability
• CVE-2023-36794 — CVSS 7.8 (high): Visual Studio Remote Code Execution Vulnerability
• CVE-2023-36796 — CVSS 7.8 (high): Visual Studio Remote Code Execution Vulnerability
• CVE-2024-20656 — CVSS 7.8 (high): Visual Studio Elevation of Privilege Vulnerability
• CVE-2024-43590 — CVSS 7.8 (high): Visual C++ Redistributable Installer Elevation of Privilege Vulnerability
• CVE-2019-1351 — CVSS 7.5 (high): A tampering vulnerability exists when Git for Visual Studio improperly handles virtual drive paths, aka 'Git for Visual Studio Tampering…
• CVE-2021-26423 — CVSS 7.5 (high): .NET Core and Visual Studio Denial of Service Vulnerability
• CVE-2025-21172 — CVSS 7.5 (high): .NET and Visual Studio Remote Code Execution Vulnerability
• CVE-2020-1161 — CVSS 7.5 (high): A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service…
• CVE-2020-1108 — CVSS 7.5 (high): A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests, aka '.NET Core & .NET Framework…
• CVE-2020-1597 — CVSS 7.5 (high): A denial of service vulnerability exists when ASP.NET Core improperly handles web requests. An attacker who successfully exploited this…
• CVE-2025-55240 — CVSS 7.3 (high): Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally.
• CVE-2025-24998 — CVSS 7.3 (high): Uncontrolled search path element in Visual Studio allows an authorized attacker to elevate privileges locally.
• CVE-2019-1211 — CVSS 7.3 (high): An elevation of privilege vulnerability exists in Git for Visual Studio when it improperly parses configuration files. An attacker who…
• CVE-2025-21206 — CVSS 7.3 (high): Visual Studio Installer Elevation of Privilege Vulnerability
• CVE-2021-1639 — CVSS 7.0 (high): Visual Studio Code Remote Code Execution Vulnerability
• CVE-2022-21871 — CVSS 7.0 (high): Microsoft Diagnostics Hub Standard Collector Runtime Elevation of Privilege Vulnerability
• CVE-2024-29060 — CVSS 6.7 (medium): Visual Studio Elevation of Privilege Vulnerability
• CVE-2020-1130 — CVSS 6.6 (medium): <p>An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector improperly handles data operations. An…
• CVE-2021-1721 — CVSS 6.5 (medium): .NET Core and Visual Studio Denial of Service Vulnerability
• CVE-2019-0757 — CVSS 6.5 (medium): A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify a…
• CVE-2019-1425 — CVSS 6.5 (medium): An elevation of privilege vulnerability exists when Visual Studio fails to properly validate hardlinks while extracting archived files, aka…
• CVE-2020-26870 — CVSS 6.1 (medium): Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the…
• CVE-2019-0657 — CVSS 5.9 (medium): A vulnerability exists in certain .Net Framework API's and Visual Studio in the way they parse URL's, aka '.NET Framework and Visual Studio…
• CVE-2023-21567 — CVSS 5.6 (medium): Visual Studio Denial of Service Vulnerability
• CVE-2020-17100 — CVSS 5.5 (medium): Visual Studio Tampering Vulnerability
• CVE-2020-0900 — CVSS 5.5 (medium): An elevation of privilege vulnerability exists when the Visual Studio Extension Installer Service improperly handles file operations, aka…
• CVE-2020-1133 — CVSS 5.5 (medium): <p>An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector improperly handles file operations. An…
• CVE-2025-32703 — CVSS 5.5 (medium): Insufficient granularity of access control in Visual Studio allows an authorized attacker to disclose information locally.
• CVE-2020-0899 — CVSS 5.5 (medium): An elevation of privilege vulnerability exists when Microsoft Visual Studio updater service improperly handles file permissions, aka…
• CVE-2024-43603 — CVSS 5.5 (medium): Visual Studio Collector Service Denial of Service Vulnerability
• CVE-2023-28299 — CVSS 5.5 (medium): Visual Studio Spoofing Vulnerability
• CVE-2023-33139 — CVSS 5.5 (medium): Visual Studio Information Disclosure Vulnerability
• CVE-2021-42277 — CVSS 5.5 (medium): Diagnostics Hub Standard Collector Elevation of Privilege Vulnerability
• CVE-2019-1077 — CVSS 5.0 (medium): An elevation of privilege vulnerability exists when the Visual Studio updater service improperly handles file permissions, aka 'Visual…
• CVE-2021-34485 — CVSS 5.0 (medium): .NET Core and Visual Studio Information Disclosure Vulnerability
• CVE-2021-42319 — CVSS 4.7 (medium): Visual Studio Elevation of Privilege Vulnerability
• CVE-2018-1037 — CVSS 4.3 (medium): An information disclosure vulnerability exists when Visual Studio improperly discloses limited contents of uninitialized memory while…
• CVE-2020-0884 — CVSS 3.7 (low): A spoofing vulnerability exists in Microsoft Visual Studio as it includes a reply URL that is not secured by SSL, aka 'Microsoft Visual…