Read the docs
TI-2019-01130 Aliases CVE-2019-1425GHSA-r2h3-mjxh-65r2

Link following in Microsoft Visual Studio 2017

Priority LOW 35CWE-59Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

An elevation of privilege vulnerability exists when Visual Studio fails to properly validate hardlinks while extracting archived files, aka 'Visual Studio Elevation of Privilege Vulnerability'.

Why it matters now

EPSS 0.03338 88th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftMicrosoft Visual Studio 2017version 15.9—No fix listedCNA
MicrosoftMicrosoft Visual Studio 201916.0; 16.3—No fix listedCNA
  • Microsoft Visual Studio 2017 VendorMicrosoft Affected version 15.9 Fixed in — No fix listed CNA
  • Microsoft Visual Studio 2019 VendorMicrosoft Affected 16.0; 16.3 Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:visual_studio_2017:15.9:*:*:*:*:*:*:*15.9VulnerableMicrosoft
cpe:2.3:a:microsoft:visual_studio_2019:16.0:*:*:*:*:*:*:*16.0VulnerableMicrosoft
cpe:2.3:a:microsoft:visual_studio_2019:16.3:*:*:*:*:*:*:*16.3VulnerableMicrosoft
  • cpe:2.3:a:microsoft:visual_studio_2017:15.9:*:*:*:*:*:*:* Versions 15.9 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:visual_studio_2019:16.0:*:*:*:*:*:*:* Versions 16.0 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:visual_studio_2019:16.3:*:*:*:*:*:*:* Versions 16.3 Vulnerable ·Microsoft

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-1425
  2. 2026-10-03 Alias added: GHSA-r2h3-mjxh-65r2

References

Patch 1

  • TI-2020-01112 A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and… KEVCVSS 3.1HIGH 7.8
  • TI-2022-16266 Visual Studio Remote Code Execution Vulnerability CVSS 3.1HIGH 8.8
  • TI-2021-15028 Visual Studio Remote Code Execution Vulnerability CVSS 3.1HIGH 7.8
  • TI-2019-01063 Improper input validation in Microsoft Visual Studio 2017 version 15.9 CVSS 3.1HIGH 8.8
  • TI-2019-01064 Improper input validation in Microsoft Visual Studio 2019 version 16.4 CVSS 3.1HIGH 8.8
  • TI-2019-01066 Improper input validation in Microsoft Visual Studio 2019 version 16.4 CVSS 3.1HIGH 8.8
See all 93 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences