CVE-2025-47959

This is like a “bad input” problem in Visual Studio—if someone can feed it carefully crafted data, Visual Studio can be tricked into running unintended commands on the computer. Because those commands run with the permissions of the currently logged-in user, it can expose that user’s files and potentially disrupt work.

This matters if your organization uses Microsoft Visual Studio 2022 and has machines running versions 17.8, 17.10, 17.12, or 17.14. The attacker must have a low-privilege authorized account on the target system and be able to influence specific inputs that Visual Studio processes. It’s only a meaningful risk if that attacker can reach those Visual Studio activities over the network (network access plus the required influence/interaction).

Treat this as an urgent patching item because attackers don’t need admin access, and they can potentially run arbitrary code as the logged-in user once they can influence Visual Studio inputs. Even though no public exploit code is recorded and KEV is not listed, the traffic-light verdict is AMBER and press attention is rising—so plan to upgrade promptly to the fixed builds.

1. Inventory and version check

   • On each workstation/VM that runs Microsoft Visual Studio 2022, record the exact installed version.
   • Flag hosts running: 17.8, 17.10, 17.12, or 17.14.

2. Determine whether you’re already fixed

   • Update targets are the fixed builds:
     • 17.10 → fixed in 17.10.16
     • 17.12 → fixed in 17.12.9
     • 17.14 → fixed in 17.14.5
     • 17.8 → fixed in 17.8.22

3. Upgrade plan

   • Schedule updates for developer machines first, then any build/CI machines that run Visual Studio.
   • After upgrading, re-check that Visual Studio reports the fixed version on each host.

4. Temporary mitigation if patching is delayed

   • Reduce the chance of an attacker influencing Visual Studio inputs by tightening access to accounts on affected machines.
   • Limit which users can log in to those machines and which ones can interact with Visual Studio workflows that consume untrusted input.

5. What to monitor after remediation

   • Monitor for unusual command execution activity under user accounts (for example, unexpected child processes spawned from Visual Studio).
   • Track whether any flagged users are repeatedly triggering Visual Studio actions that process external or untrusted input.

6. Timing note

   • KEV is not listed for this issue, and no public exploit code is on record; however, the recommended path is still to upgrade to the fixed builds listed above.

CVE-2025-47959 (CWE-77) affects Microsoft Visual Studio 2022. The mechanism is command injection: Visual Studio fails to properly neutralize special elements when using user-controlled input to build operating system commands. The attack requires an authenticated attacker with a low-privilege account on the target system and requires user interaction, with the attacker influencing specific inputs processed by Visual Studio. The impact is remote code execution under the logged-in user’s privileges (allowing control over files and data within that context). Exploitation status: not listed in CISA KEV and no public exploit code was found in the provided findings; predicted likelihood is rising (EPSS trend rising), but public likelihood numbers should not be treated as exploitation proof. Patch availability exists with fixed versions per Visual Studio branch as listed in the findings.