CVE-2025-49739: Microsoft Visual Studio

High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days.

Improper link resolution before file access ('link following') in Visual Studio allows an unauthorized attacker to elevate privileges over a network.

Affected products

• Microsoft Visual Studio: version 2015 only
• Microsoft Visual Studio 2017: from 15.0, before 15.9.75 (fixed in 15.9.75)
• Microsoft Visual Studio 2019: from 16.0, before 16.11.49 (fixed in 16.11.49)
• Microsoft Visual Studio 2022: from 17.8.0, before 17.8.23 (fixed in 17.8.23); from 17.10.0, before 17.10.17 (fixed in 17.10.17); from 17.12.0, before 17.12.10 (fixed in 17.12.10); from 17.14.0, before 17.14.8 (fixed in 17.14.8)

Published 2025-07-08. Last modified 2026-06-17.