Microsoft Visual Studio 2019 — known CVE vulnerabilities

Every CVE whose affected-product data names Microsoft Visual Studio 2019, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (118)

• CVE-2019-1354 — CVSS 8.8 (high): A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code…
• CVE-2024-28936 — CVSS 8.8 (high): Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
• CVE-2020-1416 — CVSS 8.8 (high): An elevation of privilege vulnerability exists in Visual Studio and Visual Studio Code when they load software dependencies, aka 'Visual…
• CVE-2022-35827 — CVSS 8.8 (high): Visual Studio Remote Code Execution Vulnerability
• CVE-2024-28935 — CVSS 8.8 (high): Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
• CVE-2025-21178 — CVSS 8.8 (high): Visual Studio Remote Code Execution Vulnerability
• CVE-2022-35826 — CVSS 8.8 (high): Visual Studio Remote Code Execution Vulnerability
• CVE-2025-49739 — CVSS 8.8 (high): Improper link resolution before file access ('link following') in Visual Studio allows an unauthorized attacker to elevate privileges over…
• CVE-2022-35825 — CVSS 8.8 (high): Visual Studio Remote Code Execution Vulnerability
• CVE-2022-35777 — CVSS 8.8 (high): Visual Studio Remote Code Execution Vulnerability
• CVE-2021-43877 — CVSS 8.8 (high): ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability
• CVE-2024-28934 — CVSS 8.8 (high): Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
• CVE-2024-28933 — CVSS 8.8 (high): Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
• CVE-2021-27068 — CVSS 8.8 (high): Visual Studio Remote Code Execution Vulnerability
• CVE-2024-28938 — CVSS 8.8 (high): Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
• CVE-2019-1352 — CVSS 8.8 (high): A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code…
• CVE-2024-28937 — CVSS 8.8 (high): Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
• CVE-2024-28932 — CVSS 8.8 (high): Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
• CVE-2024-28931 — CVSS 8.8 (high): Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
• CVE-2024-28930 — CVSS 8.8 (high): Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
• CVE-2024-28929 — CVSS 8.8 (high): Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
• CVE-2019-1349 — CVSS 8.8 (high): A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code…
• CVE-2019-1350 — CVSS 8.8 (high): A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code…
• CVE-2021-26701 — CVSS 8.1 (high): .NET Core Remote Code Execution Vulnerability
• CVE-2021-24112 — CVSS 8.1 (high): .NET Core Remote Code Execution Vulnerability
• CVE-2023-36897 — CVSS 8.1 (high): Visual Studio Tools for Office Runtime Spoofing Vulnerability
• CVE-2019-0727 — CVSS 7.8 (high): An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector or the Visual Studio Standard Collector allows…
• CVE-2019-1232 — CVSS 7.8 (high): An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector Service improperly impersonates certain file…
• CVE-2020-0793 — CVSS 7.8 (high): An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector Service improperly handles file operations, aka…
• CVE-2020-0810 — CVSS 7.8 (high): An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector or the Visual Studio Standard Collector allows…
• CVE-2020-1147 — CVSS 7.8 (high) — actively exploited: A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check…
• CVE-2020-1202 — CVSS 7.8 (high): An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector or the Visual Studio Standard Collector fail to…
• CVE-2020-1203 — CVSS 7.8 (high): An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector or the Visual Studio Standard Collector fail to…
• CVE-2020-1257 — CVSS 7.8 (high): An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector Service improperly handles file operations, aka…
• CVE-2020-1278 — CVSS 7.8 (high): An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector Service improperly handles file operations, aka…
• CVE-2020-1293 — CVSS 7.8 (high): An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector Service improperly handles file operations, aka…
• CVE-2020-1393 — CVSS 7.8 (high): An elevation of privilege vulnerability exists when the Windows Diagnostics Hub Standard Collector Service fails to properly sanitize…
• CVE-2020-16856 — CVSS 7.8 (high): <p>A remote code execution vulnerability exists in Visual Studio when it improperly handles objects in memory. An attacker who successfully…
• CVE-2020-16874 — CVSS 7.8 (high): <p>A remote code execution vulnerability exists in Visual Studio when it improperly handles objects in memory. An attacker who successfully…
• CVE-2020-17156 — CVSS 7.8 (high): Visual Studio Remote Code Execution Vulnerability
• CVE-2021-1651 — CVSS 7.8 (high): Diagnostics Hub Standard Collector Elevation of Privilege Vulnerability
• CVE-2021-1680 — CVSS 7.8 (high): Diagnostics Hub Standard Collector Elevation of Privilege Vulnerability
• CVE-2021-26434 — CVSS 7.8 (high): Visual Studio Elevation of Privilege Vulnerability
• CVE-2021-27064 — CVSS 7.8 (high): Visual Studio Installer Elevation of Privilege Vulnerability
• CVE-2021-28313 — CVSS 7.8 (high): Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability
• CVE-2021-28321 — CVSS 7.8 (high): Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability
• CVE-2021-28322 — CVSS 7.8 (high): Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability
• CVE-2021-36952 — CVSS 7.8 (high): Visual Studio Remote Code Execution Vulnerability
• CVE-2022-24513 — CVSS 7.8 (high): Visual Studio Elevation of Privilege Vulnerability
• CVE-2022-24767 — CVSS 7.8 (high): GitHub: Git for Windows' uninstaller vulnerable to DLL hijacking when run under the SYSTEM user account.
• CVE-2022-41032 — CVSS 7.8 (high): NuGet Client Elevation of Privilege Vulnerability
• CVE-2022-41119 — CVSS 7.8 (high): Visual Studio Remote Code Execution Vulnerability
• CVE-2023-21566 — CVSS 7.8 (high): Visual Studio Elevation of Privilege Vulnerability
• CVE-2023-21808 — CVSS 7.8 (high): .NET and Visual Studio Remote Code Execution Vulnerability
• CVE-2023-21815 — CVSS 7.8 (high): Visual Studio Remote Code Execution Vulnerability
• CVE-2023-23381 — CVSS 7.8 (high): Visual Studio Remote Code Execution Vulnerability
• CVE-2023-24897 — CVSS 7.8 (high): .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
• CVE-2023-28262 — CVSS 7.8 (high): Visual Studio Elevation of Privilege Vulnerability
• CVE-2023-28296 — CVSS 7.8 (high): Visual Studio Remote Code Execution Vulnerability
• CVE-2023-36792 — CVSS 7.8 (high): Visual Studio Remote Code Execution Vulnerability
• CVE-2023-36793 — CVSS 7.8 (high): Visual Studio Remote Code Execution Vulnerability
• CVE-2023-36794 — CVSS 7.8 (high): Visual Studio Remote Code Execution Vulnerability
• CVE-2023-36796 — CVSS 7.8 (high): Visual Studio Remote Code Execution Vulnerability
• CVE-2024-20656 — CVSS 7.8 (high): Visual Studio Elevation of Privilege Vulnerability
• CVE-2024-43590 — CVSS 7.8 (high): Visual C++ Redistributable Installer Elevation of Privilege Vulnerability
• CVE-2025-32702 — CVSS 7.8 (high): Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an unauthorized attacker to…
• CVE-2021-26423 — CVSS 7.5 (high): .NET Core and Visual Studio Denial of Service Vulnerability
• CVE-2020-1161 — CVSS 7.5 (high): A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service…
• CVE-2025-21172 — CVSS 7.5 (high): .NET and Visual Studio Remote Code Execution Vulnerability
• CVE-2022-24464 — CVSS 7.5 (high): .NET and Visual Studio Denial of Service Vulnerability
• CVE-2022-23267 — CVSS 7.5 (high): .NET and Visual Studio Denial of Service Vulnerability
• CVE-2022-21986 — CVSS 7.5 (high): .NET Denial of Service Vulnerability
• CVE-2020-1597 — CVSS 7.5 (high): A denial of service vulnerability exists when ASP.NET Core improperly handles web requests. An attacker who successfully exploited this…
• CVE-2022-38013 — CVSS 7.5 (high): .NET Core and Visual Studio Denial of Service Vulnerability
• CVE-2022-29117 — CVSS 7.5 (high): .NET and Visual Studio Denial of Service Vulnerability
• CVE-2022-29145 — CVSS 7.5 (high): .NET and Visual Studio Denial of Service Vulnerability
• CVE-2019-1351 — CVSS 7.5 (high): A tampering vulnerability exists when Git for Visual Studio improperly handles virtual drive paths, aka 'Git for Visual Studio Tampering…
• CVE-2020-1108 — CVSS 7.5 (high): A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests, aka '.NET Core & .NET Framework…
• CVE-2021-1723 — CVSS 7.5 (high): ASP.NET Core and Visual Studio Denial of Service Vulnerability
• CVE-2025-24998 — CVSS 7.3 (high): Uncontrolled search path element in Visual Studio allows an authorized attacker to elevate privileges locally.
• CVE-2021-31204 — CVSS 7.3 (high): .NET and Visual Studio Elevation of Privilege Vulnerability
• CVE-2025-55240 — CVSS 7.3 (high): Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally.
• CVE-2025-21206 — CVSS 7.3 (high): Visual Studio Installer Elevation of Privilege Vulnerability
• CVE-2025-25003 — CVSS 7.3 (high): Uncontrolled search path element in Visual Studio allows an authorized attacker to elevate privileges locally.
• CVE-2019-1211 — CVSS 7.3 (high): An elevation of privilege vulnerability exists in Git for Visual Studio when it improperly parses configuration files. An attacker who…
• CVE-2020-0789 — CVSS 7.1 (high): A denial of service vulnerability exists when the Visual Studio Extension Installer Service improperly handles hard links, aka 'Visual…
• CVE-2022-21871 — CVSS 7.0 (high): Microsoft Diagnostics Hub Standard Collector Runtime Elevation of Privilege Vulnerability
• CVE-2021-1639 — CVSS 7.0 (high): Visual Studio Code Remote Code Execution Vulnerability
• CVE-2024-29060 — CVSS 6.7 (medium): Visual Studio Elevation of Privilege Vulnerability
• CVE-2023-36759 — CVSS 6.7 (medium): Visual Studio Elevation of Privilege Vulnerability
• CVE-2020-1130 — CVSS 6.6 (medium): <p>An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector improperly handles data operations. An…
• CVE-2019-1425 — CVSS 6.5 (medium): An elevation of privilege vulnerability exists when Visual Studio fails to properly validate hardlinks while extracting archived files, aka…
• CVE-2021-1721 — CVSS 6.5 (medium): .NET Core and Visual Studio Denial of Service Vulnerability
• CVE-2022-24512 — CVSS 6.3 (medium): .NET and Visual Studio Remote Code Execution Vulnerability
• CVE-2023-36042 — CVSS 6.2 (medium): Visual Studio Denial of Service Vulnerability
• CVE-2020-26870 — CVSS 6.1 (medium): Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the…
• CVE-2019-1486 — CVSS 6.1 (medium): A spoofing vulnerability exists in Visual Studio Live Share when a guest connected to a Live Share session is redirected to an arbitrary…
• CVE-2021-31957 — CVSS 5.9 (medium): ASP.NET Core Denial of Service Vulnerability
• CVE-2021-41355 — CVSS 5.7 (medium): .NET Core and Visual Studio Information Disclosure Vulnerability
• CVE-2023-21567 — CVSS 5.6 (medium): Visual Studio Denial of Service Vulnerability
• CVE-2021-34532 — CVSS 5.5 (medium): ASP.NET Core and Visual Studio Information Disclosure Vulnerability
• CVE-2020-0899 — CVSS 5.5 (medium): An elevation of privilege vulnerability exists when Microsoft Visual Studio updater service improperly handles file permissions, aka…
• CVE-2023-33139 — CVSS 5.5 (medium): Visual Studio Information Disclosure Vulnerability
• CVE-2020-1133 — CVSS 5.5 (medium): <p>An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector improperly handles file operations. An…
• CVE-2024-43603 — CVSS 5.5 (medium): Visual Studio Collector Service Denial of Service Vulnerability
• CVE-2020-0900 — CVSS 5.5 (medium): An elevation of privilege vulnerability exists when the Visual Studio Extension Installer Service improperly handles file operations, aka…
• CVE-2023-28263 — CVSS 5.5 (medium): Visual Studio Information Disclosure Vulnerability
• CVE-2021-42277 — CVSS 5.5 (medium): Diagnostics Hub Standard Collector Elevation of Privilege Vulnerability
• CVE-2022-30184 — CVSS 5.5 (medium): .NET and Visual Studio Information Disclosure Vulnerability
• CVE-2020-17100 — CVSS 5.5 (medium): Visual Studio Tampering Vulnerability
• CVE-2023-28299 — CVSS 5.5 (medium): Visual Studio Spoofing Vulnerability
• CVE-2025-32703 — CVSS 5.5 (medium): Insufficient granularity of access control in Visual Studio allows an authorized attacker to disclose information locally.
• CVE-2020-8927 — CVSS 5.3 (medium): A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot"…
• CVE-2021-34485 — CVSS 5.0 (medium): .NET Core and Visual Studio Information Disclosure Vulnerability
• CVE-2019-1077 — CVSS 5.0 (medium): An elevation of privilege vulnerability exists when the Visual Studio updater service improperly handles file permissions, aka 'Visual…
• CVE-2024-30052 — CVSS 4.7 (medium): Visual Studio Remote Code Execution Vulnerability
• CVE-2021-42319 — CVSS 4.7 (medium): Visual Studio Elevation of Privilege Vulnerability
• CVE-2020-0884 — CVSS 3.7 (low): A spoofing vulnerability exists in Microsoft Visual Studio as it includes a reply URL that is not secured by SSL, aka 'Microsoft Visual…