CVE-2026-21523
Published: 10 February 2026
Summary
CVE-2026-21523 is a high-severity Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367) vulnerability in Microsoft Visual Studio Code. Its CVSS base score is 8.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 10.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as Enterprise AI Assistants; in the Supply Chain and Deployment risk domain.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-21523 is a time-of-check time-of-use (TOCTOU) race condition vulnerability, classified under CWE-367, affecting GitHub Copilot and Visual Studio. Published on 2026-02-10, it has a CVSS v3.1 base score of 8.0 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant confidentiality, integrity, and availability impacts.
An authorized attacker with low privileges can exploit this vulnerability over a network by triggering the race condition, which requires user interaction. Successful exploitation allows arbitrary code execution on the affected system.
Microsoft's Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21523 provides details on mitigation and patching guidance for the affected components.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7345
Vulnerability details
Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a network.
- CWE(s)
AI Security AnalysisAI
- AI Category
- Enterprise AI Assistants
- Risk Domain
- Supply Chain and Deployment
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: github copilot
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
TOCTOU race condition in client-side IDE/tool (VS/Copilot) directly enables arbitrary code execution via exploitation of the client application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the TOCTOU race condition by requiring identification, testing, and installation of patches for the specific vulnerability in GitHub Copilot and Visual Studio.
Protects against arbitrary code execution resulting from TOCTOU exploitation through memory protections such as DEP, ASLR, and sandboxing.
Monitors software execution and performs integrity checks to detect and prevent unauthorized code execution or modifications enabled by the race condition.