CVE-2024-49050
Published: 12 November 2024
Summary
CVE-2024-49050 is a high-severity Trust Boundary Violation (CWE-501) vulnerability in Microsoft Python. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 13.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-49050 is a remote code execution vulnerability affecting the Python extension for Visual Studio Code. It carries a CVSS 3.1 base score of 8.8 with a vector indicating network attack vector, low attack complexity, no required privileges, and required user interaction, resulting in high impact to confidentiality, integrity, and availability. The issue is also associated with CWE-501.
An attacker can exploit the flaw over the network without authentication to achieve remote code execution on an affected system when a user interacts with malicious content. The CVSS metrics confirm that successful exploitation grants full control over the impacted confidentiality, integrity, and availability properties.
The Microsoft Security Response Center advisory published at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49050 addresses mitigation steps for the vulnerability.
EPSS for CVE-2024-49050 rose from a low baseline to a peak of 0.0548 on 2025-12-11 before receding to the current value of 0.0299, indicating that exploitation interest emerged after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-43918
Vulnerability details
Visual Studio Code Python Extension Remote Code Execution Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Establishes and maintains trust boundaries with external organizations before allowing their systems to interact with organization resources.
Prevents information from crossing trust boundaries without explicit approved authorizations.
Defining interfaces, controls, and trust responsibilities in agreements helps prevent violations of trust boundaries during data exchanges.
Authorizing and reviewing connections helps maintain proper trust boundaries between internal components.
Controlling media movement outside controlled areas maintains separation between internal and external trust boundaries.
Review of inter-system matching programs identifies and corrects trust-boundary violations before data crosses organizational or policy domains.
Defines explicit trust boundaries for PII use via documented purposes and prevents processing outside those boundaries.
Explicitly binding attributes to information crossing trust boundaries prevents loss of security context that leads to trust-boundary violations.