Microsoft Fixes Visual Studio Code Elevation of Privilege Flaws
Vulnerability Disclosure · 4 sources · Updated 4mo ago · First seen May 25, 2026
Microsoft disclosed and patched multiple elevation of privilege vulnerabilities affecting Visual Studio Code and its JS Debug Extension, including CVE-2025-24039, CVE-2025-24042, and CVE-2026-41613. The latest issue, CVE-2026-41613, is rated Important with a CVSS 3.1 score of 8.8 and is described as a session fixation flaw mapped to CWE-384 and CWE-78. Microsoft said the vulnerability affects Visual Studio Code itself, while the earlier 2025 advisories cover separate privilege-escalation bugs in the core product and the JS Debug Extension.
According to Microsoft, exploitation of CVE-2026-41613 requires user interaction, specifically convincing a target to open a malicious file in VS Code, and could allow an attacker to obtain the permissions of the MCP Server’s managed identity. Microsoft said the flaw was not publicly disclosed and not exploited at the time of release, assessed exploitation as less likely, and made a fix available; the issue was credited to Elad Luz of Oasis Security through coordinated disclosure.
