← All advisories

High severity8.0NVD Advisory· Published Feb 10, 2026· Updated Jun 17, 2026

CVE-2026-21523

CVE-2026-21523

Description

Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a network.

Affected products

4

Microsoft/Visual Studiollm-fuzzy2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: 1.0.0
Microsoft/Visual Studio Code
cpe:2.3:a:microsoft:visual_studio_code:*:*:*:*:*:-:*:*
Range: <1.109.2
Microsoft/Visual Studio Code CoPilot Chat Extensioncpe-rescue
Range: 0.27.0

Patches

Vulnerability mechanics

References

1

msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21523nvdVendor Advisory

News mentions

0

No linked articles in our index yet.