CVE-2024-49050
Microsoft Python ≤ 2024.18.2
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSummary
CVE-2024-49050 is a high-severity Trust Boundary Violation (CWE-501) vulnerability in Microsoft Python. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 34% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-4 (Information Flow Enforcement) and AC-16 (Security and Privacy Attributes) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2024-49050 is a remote code execution vulnerability affecting the Python extension for Visual Studio Code. It carries a CVSS 3.1 base score of 8.8 with a vector indicating network attack vector, low attack complexity, no required privileges, and required user interaction, resulting in high impact to confidentiality, integrity, and availability. The issue is also associated with CWE-501.
An attacker can exploit the flaw over the network without authentication to achieve remote code execution on an affected system when a user interacts with malicious content. The CVSS metrics confirm that successful exploitation grants full control over the impacted confidentiality, integrity, and availability properties.
The Microsoft Security Response Center advisory published at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49050 addresses mitigation steps for the vulnerability.
EPSS for CVE-2024-49050 rose from a low baseline to a peak of 0.0548 on 2025-12-11 before receding to the current value of 0.0299, indicating that exploitation interest emerged after disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-43918
Vulnerability Data
Visual Studio Code Python Extension Remote Code Execution Vulnerability
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Information flow enforcement directly stops trusted and untrusted data from being combined by applying rules that govern allowable data movements and combinations.
Associating explicit security attributes with data objects enables enforcement mechanisms that keep trust levels from being mixed inside structures.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure-development practices (coding standards, reviews, validation) directly prevent mixing trusted and untrusted data inside the same structures.
Documented data-flow representations make trust boundaries explicit and help surface mixing of trusted/untrusted data.
Logical segmentation and access controls enforce separation between trust domains, reducing the chance of co-mingled data structures.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure architecture principles require explicit trust zones and data segregation, mitigating mixing of trusted/untrusted data.
Secure coding standards can enforce input validation and data tagging, but do not guarantee architectural separation.
Secure development lifecycle mandates separation of trusted and untrusted data flows, directly preventing mixing in the same structure.
Application security requirements include explicit trust-boundary definitions and data classification at interfaces.
Network segregation reduces external mixing but does not address internal data-structure trust violations.
Information access restriction limits who sees data but does not prevent mixing trusted and untrusted data within structures.