High severity · published Aug 9, 2022
CVE-2022-35825
Visual Studio Remote Code Execution Vulnerability
8.8
CVSS
2.2%
EPSS
No
On KEV
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MV
Microsoft Visual Studio 2012 Update 5 · Microsoft
11.0.0 before 11.0.61252.0 · source: vendor
MV
Microsoft Visual Studio 2013 Update 5 · Microsoft
12.0.0 before 12.0.40699.0 · source: vendor
MV
Microsoft Visual Studio 2015 Update 3 · Microsoft
14.0.0 before 14.0.27552.0 · source: vendor
MV
Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) · Microsoft
15.9.0 before 15.9.50 · source: vendor
MV
Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) · Microsoft
16.11.0 before 16.11.18 · source: vendor
MV
Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8) · Microsoft
15.0.0 before 16.9.24 · source: vendor
MV
Microsoft Visual Studio 2022 version 17.0 · Microsoft
17.0.0 before 17.0.13 · source: vendor
MV
Microsoft Visual Studio 2022 version 17.2 · Microsoft
17.2.0 before 17.2.7 · source: vendor
VS
Visual Studio · Microsoft
2012; 2013; 2015 · source: NVD
VS
Visual Studio 2017 · Microsoft
15.9 · source: NVD
VS
Visual Studio 2019 · Microsoft
16.9; 16.11 · source: NVD
VS
Visual Studio 2022 · Microsoft
17.0; 17.2 · source: NVD
Affected product
MV
Microsoft Visual Studio 2012 Update 5
Microsoft
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-35825
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-35825
msrc.microsoft.com
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35825
More from Microsoft Visual Studio 2012 Update 5
8.8
CVE-2022-35827
Visual Studio Remote Code Execution Vulnerability
8.8
CVE-2022-35826
Visual Studio Remote Code Execution Vulnerability
8.8
CVE-2022-35777
Visual Studio Remote Code Execution Vulnerability