CVE-2022-41034: Visual Studio Code remote code execution via local vector

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 7.8 with high EPSS (99.27th percentile) and full confidentiality, integrity and availability impact, though exploitation requires local access and user interaction and no KEV listing exists.

What it is

CVE-2022-41034 is a remote code execution vulnerability in Microsoft Visual Studio Code, rated HIGH at CVSS 3.1 score 7.8. The record gives no root-cause detail (CWE is listed as insufficient information), so the exact flaw mechanism is unknown from the supplied data. It matters because successful exploitation yields full compromise of confidentiality, integrity and availability on the affected host.

Impact

An attacker gains code execution with high impact to confidentiality, integrity and availability, meaning arbitrary code can run in the context of the VS Code user. No privilege escalation is implied by the vector, since PR:N and scope is unchanged.

Attack surface

The vector AV:L/AC:L/PR:N/UI:R indicates local access with no privileges required but user interaction required, so the attacker must get the victim to open or interact with crafted content in VS Code. It is not remotely reachable without that local, user-driven step.

Exploitation

Not listed in CISA KEV, but EPSS is 0.67469 (99.27th percentile), indicating a high predicted likelihood of exploitation activity. The only references are Microsoft advisories, one tagged Patch and Vendor Advisory, so no public exploit details are confirmed in this record.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2022-41034 as the first action.
• Keep Visual Studio Code and its extensions updated to current supported releases.
• Restrict opening untrusted workspaces, folders or files in VS Code, and use Workspace Trust to limit automatic execution of workspace code.
• Run VS Code with least privilege and avoid running it as an administrator or root.
• Monitor vendor advisories for follow-up guidance if the root cause is clarified.

Detection

• Monitor for unexpected child processes spawned by VS Code (for example shells, scripting hosts or network utilities).
• Alert on VS Code processes making unusual outbound network connections or writing to unexpected locations.
• Audit VS Code extension installs and workspace trust decisions for untrusted or unknown sources.
• Correlate endpoint telemetry for file writes or process creation tied to recently opened untrusted workspaces.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.