VS
Product
Visual Studio 2022
On CISA KEVExploited in the wild
156
CVEs
2
On KEV
9.9
Max CVSS
4
New 30D
Severity mix
Critical 7High 116Medium 33Low 0
Watch
Add Visual Studio 2022 to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-29117 | 7.5 | May 10 | .NET and Visual Studio Denial of Service Vulnerability Affected: 17.0; 17.1 |
| CVE-2022-23267 | 7.5 | May 10 | .NET and Visual Studio Denial of Service Vulnerability Affected: 17.0; 17.1 |
| CVE-2022-24464 | 7.5 | Mar 9 | .NET and Visual Studio Denial of Service Vulnerability Affected: 17.0 before 17.0.7 |
| CVE-2022-21986 | 7.5 | Feb 9 | .NET Denial of Service Vulnerability Affected: 17.0 before 17.0.6 |
| CVE-2026-96222 | 7.4 | Oct 13 | Active Directory Federation Services (AD FS) Spoofing Vulnerability Affected: 17.14.0 before 17.14.42 |
| CVE-2026-32177 | 7.3 | May 12 | .NET Elevation of Privilege Vulnerability Affected: 17.12.0 before 17.12.20; 17.14.0 before 17.14.32 |
| CVE-2025-55240 | 7.3 | Oct 14 | Visual Studio Elevation of Privilege Vulnerability Affected: 17.10.0 before 17.10.20; 17.12.0 before 17.12.13; 17.14.0 before 17.14.17 |
| CVE-2025-29804 | 7.3 | Apr 8 | Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally Affected: 17.8.0 before 17.8.20; 17.10.0 before 17.10.13; 17.12.0 before 17.12.7; 17.13.0 before 17.13.6 |
| CVE-2025-29802 | 7.3 | Apr 8 | Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally Affected: 17.8.0 before 17.8.20; 17.10.0 before 17.10.13; 17.12.0 before 17.12.7 |
| CVE-2025-25003 | 7.3 | Mar 11 | Uncontrolled search path element in Visual Studio allows an authorized attacker to elevate privileges locally Affected: 17.8.0 before 17.8.19; 17.10.0 before 17.10.12; 17.12.0 before 17.12.6; 17.13.0 before 17.13.3 |
| CVE-2025-24998 | 7.3 | Mar 11 | Uncontrolled search path element in Visual Studio allows an authorized attacker to elevate privileges locally Affected: 17.8.0 before 17.8.19; 17.10.0 before 17.10.12; 17.12.0 before 17.12.6; 17.13.0 before 17.13.3 |
| CVE-2025-21206 | 7.3 | Feb 11 | Visual Studio Installer Elevation of Privilege Vulnerability Affected: 17.8 before 17.8.18; 17.10 before 17.10.11; 17.12 before 17.12.5 |
| CVE-2025-21405 | 7.3 | Jan 14 | Visual Studio Elevation of Privilege Vulnerability Affected: 17.12.0 before 17.12.4 |
| CVE-2025-21173 | 7.3 | Jan 14 | .NET Elevation of Privilege Vulnerability Affected: 17.6.0 before 17.6.22; 17.8.0 before 17.8.17; 17.10.0 before 17.10.10; 17.12.0 before 17.12.4 |
| CVE-2024-38081 | 7.3 | Jul 9 | .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability Affected: 17.4 before 17.4.21; 17.6 before 17.6.17; 17.8 before 17.8.12 |
| CVE-2024-21409 | 7.3 | Apr 9 | .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability Affected: 17.4.0 before 17.4.18; 17.6.0 before 17.6.14; 17.8.0 before 17.8.9; 17.9.0 before 17.9.6 |
| CVE-2023-33135 | 7.3 | Jun 14 | .NET and Visual Studio Elevation of Privilege Vulnerability Affected: 17.0 before 17.0.22; 17.2 before 17.2.16; 17.4 before 17.4.8; 17.6 before 17.6.3 |
| CVE-2023-33128 | 7.3 | Jun 14 | .NET and Visual Studio Remote Code Execution Vulnerability Affected: 17.0 before 17.0.22; 17.2 before 17.2.16; 17.4 before 17.4.8; 17.6 before 17.6.3 |
| CVE-2023-33126 | 7.3 | Jun 14 | .NET and Visual Studio Remote Code Execution Vulnerability Affected: 17.0 before 17.0.22; 17.2 before 17.2.16; 17.4 before 17.4.8; 17.6 before 17.6.3 |
| CVE-2025-47959 | 7.1 | Jun 13 | Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an authorized attacker to execute code over a network Affected: 17.8.0 before 17.8.22; 17.10.0 before 17.10.16; 17.12.0 before 17.12.9; 17.14.0 before 17.14.5 |
| CVE-2026-69806 | 7.0 | Sep 8 | .NET Elevation of Privilege Vulnerability Affected: 17.14.0 before 17.14.40 |
| CVE-2026-62897 | 7.0 | Aug 11 | .NET Framework Remote Code Execution Vulnerability Affected: 17.14.0 before 17.14.38 |
| CVE-2025-24070 | 7.0 | Mar 11 | Weak authentication in ASP.NET Core & Visual Studio allows an unauthorized attacker to elevate privileges over a network Affected: 17.8.0 before 17.8.19; 17.10.0 before 17.10.12; 17.12.0 before 17.12.6; 17.13.0 before 17.13.3 |
| CVE-2024-21319 | 6.8 | Jan 9 | Microsoft Identity Denial of service vulnerability Affected: 17.2.0 before 17.2.23; 17.4.0 before 17.4.15; 17.6.0 before 17.6.11; 17.8.0 before 17.8.4 |
| CVE-2025-62214 | 6.7 | Nov 11 | Visual Studio Remote Code Execution Vulnerability Affected: 17.14.0 before 17.14.17 |
| CVE-2024-49044 | 6.7 | Nov 12 | Visual Studio Elevation of Privilege Vulnerability Affected: 17.6.0 before 17.6.21; 17.8.0 before 17.8.16; 17.10.0 before 17.10.9; 17.11.0 before 17.11.6 |
| CVE-2024-29060 | 6.7 | Jun 11 | Visual Studio Elevation of Privilege Vulnerability Affected: 17.4 before 17.4.20; 17.6 before 17.6.16; 17.8 before 17.8.11; 17.10 before 17.10.2 |
| CVE-2023-36759 | 6.7 | Sep 12 | Visual Studio Elevation of Privilege Vulnerability Affected: 17.2.0 before 17.2.19; 17.4.0 before 17.4.11; 17.6.0 before 17.6.7; 17.7.0 before 17.7.4 |
| CVE-2026-58649 | 6.5 | Sep 8 | .NET Information Disclosure Vulnerability Affected: 17.14.0 before 17.14.40 |
| CVE-2026-62902 | 6.5 | Aug 11 | .NET Information Disclosure Vulnerability Affected: 17.14.0 before 17.14.38 |
| CVE-2026-50659 | 6.5 | Jul 14 | .NET Spoofing Vulnerability Affected: 17.12.0 before 17.12.22; 17.14.0 before 17.14.36 |
| CVE-2024-38167 | 6.5 | Aug 13 | .NET and Visual Studio Information Disclosure Vulnerability Affected: 17.6.0 before 17.6.18; 17.8.0 before 17.8.13; 17.10.0 before 17.10.6 |
| CVE-2023-36799 | 6.5 | Sep 12 | .NET Core and Visual Studio Denial of Service Vulnerability Affected: 17.2 before 17.2.19; 17.4 before 17.4.11; 17.6 before 17.6.7; 17.7 before 17.7.4 |
| CVE-2023-36897 | 6.5 | Aug 8 | Visual Studio Tools for Office Runtime Spoofing Vulnerability Affected: 17.2.0 before 17.2.18; 17.4.0 before 17.4.10; 17.6.0 before 17.6.6 |
| CVE-2023-32032 | 6.5 | Jun 14 | .NET and Visual Studio Elevation of Privilege Vulnerability Affected: 17.0 before 17.0.22; 17.2 before 17.2.16; 17.4 before 17.4.8; 17.6 before 17.6.3 |
| CVE-2020-8927 | 6.5 | Sep 15 | A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger… Affected: 17.0 through 17.0.7; 17.1 |
| CVE-2024-30045 | 6.3 | May 14 | .NET and Visual Studio Remote Code Execution Vulnerability Affected: 17.4.0 before 17.4.19; 17.6.0 before 17.6.15; 17.8.0 before 17.8.10; 17.9.0 before 17.9.7 |
| CVE-2022-24512 | 6.3 | Mar 9 | .NET and Visual Studio Remote Code Execution Vulnerability Affected: 17.0 before 17.0.7 |
| CVE-2026-85790 | 5.9 | Oct 13 | Microsoft QUIC Information Disclosure Vulnerability Affected: 17.14.0 before 17.14.42 |
| CVE-2026-69304 | 5.9 | Sep 8 | ASP.NET Core Denial of Service Vulnerability Affected: 17.14.0 before 17.14.40 |
| CVE-2026-62900 | 5.9 | Aug 11 | .NET Information Disclosure Vulnerability Affected: 17.14.0 before 17.14.38 |
| CVE-2026-62899 | 5.9 | Aug 11 | .NET Security Feature Bypass Vulnerability Affected: 17.14.0 before 17.14.38 |
| CVE-2024-30046 | 5.9 | May 14 | Visual Studio Denial of Service Vulnerability Affected: 17.4.0 before 17.4.19; 17.6.0 before 17.6.15; 17.8.0 before 17.8.10; 17.9.0 before 17.9.7 |
| CVE-2025-55248 | 5.7 | Oct 14 | .NET, .NET Framework, and Visual Studio Information Disclosure Vulnerability Affected: 17.10.0 before 17.10.20; 17.12.0 before 17.12.13; 17.14.0 before 17.14.17 |
| CVE-2023-21567 | 5.6 | Feb 14 | Visual Studio Denial of Service Vulnerability Affected: 17.0 before 17.0.19; 17.2 before 17.2.13; 17.4 before 17.4.5 |
| CVE-2026-50526 | 5.5 | Jul 14 | .NET Tampering Vulnerability Affected: 17.12.0 before 17.12.22; 17.14.0 before 17.14.36 |
| CVE-2025-32703 | 5.5 | May 13 | Insufficient granularity of access control in Visual Studio allows an authorized attacker to disclose information locally Affected: 17.8.0 before 17.8.21; 17.10.0 before 17.10.14; 17.12.0 before 17.12.8; 17.13.0 before 17.13.7 |
| CVE-2024-43603 | 5.5 | Oct 8 | Visual Studio Collector Service Denial of Service Vulnerability Affected: 17.6.0 before 17.6.20; 17.8.0 before 17.8.15; 17.10.0 before 17.10.8; 17.11.0 before 17.11.5 |
| CVE-2023-36558 | 5.5 | Nov 14 | ASP.NET Core Security Feature Bypass Vulnerability Affected: 17.2 before 17.2.22; 17.4 before 17.4.14; 17.6 before 17.6.10; 17.7 before 17.7.7 |
| CVE-2023-36042 | 5.5 | Nov 14 | Visual Studio Denial of Service Vulnerability Affected: 17.2 before 17.2.22; 17.4 before 17.4.14; 17.6 before 17.6.10; 17.7 before 17.7.7 |