Malicious code loophole in Microsoft Agentic AI and Visual Studio closed

Attackers can target a vulnerability in Microsoft Agentic AI and Visual Studio. If an attack succeeds, they can execute malicious code and very likely compromise systems completely. A security update is available for download.

Malicious code via the network

According to a warning message, the vulnerability (CVE-2025-55319) is classified as "high". According to the brief description of the vulnerability, remote attacks are possible, and attackers can execute malicious code via a network. Further details on the attack process are currently unknown. The warning message states that there are currently no attacks.

Microsoft classifies the patch as important. As a result, admins should react promptly. The developers assure that they have closed the gap in Visual Studio Code 1.104.0. According to them, previous versions up to and including 1.0.0 are vulnerable.

On Patchday this month, Microsoft closed numerous other security gaps in Office, Windows & Co.

(des)