Read the docs
TI-2019-00807 Aliases CVE-2019-1077GHSA-v6mc-r5p8-5hxq

An elevation of privilege vulnerability exists when the Visual Studio updater service…

Priority LOW 26Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

An elevation of privilege vulnerability exists when the Visual Studio updater service improperly handles file permissions, aka 'Visual Studio Elevation of Privilege Vulnerability'.

Why it matters now

EPSS 0.01755 78th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftMicrosoft Visual Studio 2017version 15.9—No fix listedCNA
MicrosoftMicrosoft Visual Studio 201916.0; 16.1—No fix listedCNA
  • Microsoft Visual Studio 2017 VendorMicrosoft Affected version 15.9 Fixed in — No fix listed CNA
  • Microsoft Visual Studio 2019 VendorMicrosoft Affected 16.0; 16.1 Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:visual_studio_2017:15.9:*:*:*:*:*:*:*15.9VulnerableMicrosoft
cpe:2.3:a:microsoft:visual_studio_2019:16.0:*:*:*:*:*:*:*16.0VulnerableMicrosoft
cpe:2.3:a:microsoft:visual_studio_2019:16.1:*:*:*:*:*:*:*16.1VulnerableMicrosoft
  • cpe:2.3:a:microsoft:visual_studio_2017:15.9:*:*:*:*:*:*:* Versions 15.9 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:visual_studio_2019:16.0:*:*:*:*:*:*:* Versions 16.0 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:visual_studio_2019:16.1:*:*:*:*:*:*:* Versions 16.1 Vulnerable ·Microsoft

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-1077
  2. 2026-10-03 Alias added: GHSA-v6mc-r5p8-5hxq

References

Patch 1

  • TI-2020-01112 A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and… KEVCVSS 3.1HIGH 7.8
  • TI-2022-16266 Visual Studio Remote Code Execution Vulnerability CVSS 3.1HIGH 8.8
  • TI-2021-15028 Visual Studio Remote Code Execution Vulnerability CVSS 3.1HIGH 7.8
  • TI-2019-01063 Improper input validation in Microsoft Visual Studio 2017 version 15.9 CVSS 3.1HIGH 8.8
  • TI-2019-01064 Improper input validation in Microsoft Visual Studio 2019 version 16.4 CVSS 3.1HIGH 8.8
  • TI-2019-01066 Improper input validation in Microsoft Visual Studio 2019 version 16.4 CVSS 3.1HIGH 8.8
See all 93 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences