CVE-2025-24039
Published: 11 February 2025
Summary
CVE-2025-24039 is a high-severity Uncontrolled Search Path Element (CWE-427) vulnerability in Microsoft Visual Studio Code. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique DLL (T1574.001); ranked at the 40.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-14 (Signed Components) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Timely flaw remediation through patching Visual Studio Code directly eliminates the untrusted search path vulnerability enabling privilege escalation.
Requiring signed components prevents Visual Studio Code from loading malicious unsigned DLLs placed by an attacker in untrusted search paths.
Malicious code protection scans for and blocks execution of attacker-placed malicious files exploited via Visual Studio Code's untrusted search path.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CWE-427 Untrusted Search Path vulnerability directly enables DLL Search Order Hijacking (T1038) to achieve local privilege escalation.
NVD Description
Visual Studio Code Elevation of Privilege Vulnerability
Deeper analysisAI
CVE-2025-24039 is an Elevation of Privilege vulnerability affecting Visual Studio Code. Classified under CWE-427 (Untrusted Search Path), it carries a CVSS v3.1 base score of 7.3 (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H), indicating a high-severity issue published on 2025-02-11.
A local attacker with low privileges (PR:L) can exploit this vulnerability under low complexity conditions (AC:L) that require user interaction (UI:R). Successful exploitation enables high-impact effects on confidentiality, integrity, and availability (C:H/I:H/A:H) with unchanged scope (S:U), typically allowing the attacker to elevate privileges on the affected system.
Mitigation guidance is available in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24039.
Details
- CWE(s)