Cyber Resilience

CVE-2025-49739

High

Published: 08 July 2025

Published
08 July 2025
Modified
16 July 2025
KEV Added
—
Patch
—
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0091 76.2th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-49739 is a high-severity Link Following (CWE-59) vulnerability in Microsoft Visual Studio 2022. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 23.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-6 (Least Privilege).

Deeper analysis

CVE-2025-49739 is an improper link resolution before file access vulnerability, commonly referred to as 'link following', affecting Visual Studio. Published on 2025-07-08, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and maps to CWE-59: Improper Link Resolution Before File Access. The flaw enables unauthorized privilege elevation due to inadequate validation of symbolic links prior to file operations.

An unauthorized attacker can exploit this vulnerability over a network with low attack complexity and no required privileges, though it demands user interaction. Successful exploitation allows the attacker to elevate privileges, achieving high impacts on confidentiality, integrity, and availability of the affected system.

The Microsoft Security Response Center has published an update guide detailing mitigations and patches for CVE-2025-49739 at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49739. Security practitioners should consult this advisory for specific remediation steps.

EU & UK References

Vulnerability details

Improper link resolution before file access ('link following') in Visual Studio allows an unauthorized attacker to elevate privileges over a network.

CWE(s)
CWE-59

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

Direct local privilege escalation via symlink following (CWE-59) in Visual Studio file operations.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-21419Same vendor: Microsoft
CVE-2026-25187Same vendor: Microsoft
CVE-2025-29795Same vendor: Microsoft
CVE-2025-60710Same vendor: Microsoft
CVE-2025-21420Same vendor: Microsoft
CVE-2026-20941Same vendor: Microsoft
CVE-2025-24998Same product: Microsoft Visual Studio 2017
CVE-2025-21331Same vendor: Microsoft
CVE-2026-41091Same vendor: Microsoft
CVE-2025-21391Same vendor: Microsoft

Affected Assets

microsoft
visual studio
2015
microsoft
visual studio 2017
15.0 — 15.9.75
microsoft
visual studio 2019
16.0 — 16.11.49
microsoft
visual studio 2022
17.8.0 — 17.8.23 · 17.10.0 — 17.10.17 · 17.12.0 — 17.12.10

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly mandates timely remediation of identified flaws, such as patching Visual Studio for the improper link resolution vulnerability in CVE-2025-49739.

RA-5 Vulnerability Monitoring and Scanning partial match
detect

Requires vulnerability scanning to identify unpatched Visual Studio instances susceptible to symlink-based privilege escalation in this CVE.

AC-6 Least Privilege partial match
prevent

Enforces least privilege on processes like Visual Studio to limit the scope and success of privilege elevation via improper symlink following.

References