Visual Studio Remote Code Execution Vulnerability
Priority MEDIUM 41Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
<p>A remote code execution vulnerability exists in Visual Studio when it improperly handles objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.</p> <p>To exploit the vulnerability, an attacker would have to convince a user to open a specially crafted file with an affected version of Visual Studio.</p> <p>The update addresses the vulnerability by correcting how Visual Studio handles objects in memory.</p>
Why it matters now
EPSS 0.04285 91st percentileScored 2026-11-07
Fix Fixed Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6) (Microsoft): publicationMicrosoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) (Microsoft): publication+5 more products
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Microsoft | Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6) | 16.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) | 15.9.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft Visual Studio 2019 version 16.0 | 16.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3) | 16.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft Visual Studio 2012 Update 5 | 11.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft Visual Studio 2013 Update 5 | 12.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft Visual Studio 2015 Update 3 | 14.0.0 to before publication | publication | Patch available | CNA |
- Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6) VendorMicrosoft Affected 16.0.0 to before publication Fixed in publication Patch available CNA
- Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) VendorMicrosoft Affected 15.9.0 to before publication Fixed in publication Patch available CNA
- Microsoft Visual Studio 2019 version 16.0 VendorMicrosoft Affected 16.0 to before publication Fixed in publication Patch available CNA
- Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3) VendorMicrosoft Affected 16.0 to before publication Fixed in publication Patch available CNA
- Microsoft Visual Studio 2012 Update 5 VendorMicrosoft Affected 11.0.0 to before publication Fixed in publication Patch available CNA
- Microsoft Visual Studio 2013 Update 5 VendorMicrosoft Affected 12.0.0 to before publication Fixed in publication Patch available CNA
- Microsoft Visual Studio 2015 Update 3 VendorMicrosoft Affected 14.0.0 to before publication Fixed in publication Patch available CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:visual_studio:2012:update_5:*:*:*:*:*:* | 2012 update_5 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:visual_studio:2013:update_5:*:*:*:*:*:* | 2013 update_5 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:visual_studio:2015:update_3:*:*:*:*:*:* | 2015 update_3 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:visual_studio_2017:*:*:*:*:*:*:*:* | 15.0 – 15.8 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:visual_studio_2019:*:*:*:*:*:*:*:* | 16.0 – 16.3; 16.5 – 16.6 | Vulnerable | Microsoft |
- cpe:2.3:a:microsoft:visual_studio:2012:update_5:*:*:*:*:*:* Versions 2012 update_5 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:visual_studio:2013:update_5:*:*:*:*:*:* Versions 2013 update_5 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:visual_studio:2015:update_3:*:*:*:*:*:* Versions 2015 update_3 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:visual_studio_2017:*:*:*:*:*:*:*:* Versions 15.0 – 15.8 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:visual_studio_2019:*:*:*:*:*:*:*:* Versions 16.0 – 16.3; 16.5 – 16.6 Vulnerable ·Microsoft
Remediation
- Fix · CNA Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6) (Microsoft) Fixed in publication
- Fix · CNA Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) (Microsoft) Fixed in publication
- Fix · CNA Microsoft Visual Studio 2019 version 16.0 (Microsoft) Fixed in publication
- Fix · CNA Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3) (Microsoft) Fixed in publication
- Fix · CNA Microsoft Visual Studio 2012 Update 5 (Microsoft) Fixed in publication
- Fix · CNA Microsoft Visual Studio 2013 Update 5 (Microsoft) Fixed in publication
- Fix · CNA Microsoft Visual Studio 2015 Update 3 (Microsoft) Fixed in publication
Timeline
- 2026-10-02 Threatist record created from CVE-2020-16874
- 2026-10-03 Alias added: GHSA-vjmv-f9r4-765g
More Microsoft Visual Studio vulnerabilities
- TI-2022-16266 Visual Studio Remote Code Execution Vulnerability CVSS 3.1HIGH 8.8
- TI-2008-03546 Heap-based buffer overflow in the MaskedEdit ActiveX control in Msmask32.ocx 6.0.81.69… CVSS 2.0HIGH 9.3
- TI-2009-02381 The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio… CVSS 3.1HIGH 8.8
- TI-2009-00858 The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio… CVSS 3.1HIGH 8.8
- TI-2009-02389 Heap-based buffer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2… CVSS 2.0HIGH 9.3
- TI-2009-02388 Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3… CVSS 2.0HIGH 9.3
Sources
- CVE-2020-16874 · CVE Program
- CVE-2020-16874 · NVD
- FIRST EPSS
- GHSA-vjmv-f9r4-765g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences