CVE-2020-16856 Visual Studio Remote Code Execution Vulnerability
Attackers can execute arbitrary code by tricking users into opening a malicious file in Visual Studio, potentially gaining full system control.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-16856?
CVE-2020-16856 is a high-severity memory corruption vulnerability in Microsoft Visual Studio, published on 11 Sep 2020. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
<p>A remote code execution vulnerability exists in Visual Studio when it improperly handles objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.</p> <p>To exploit the vulnerability, an attacker would have to convince a user to open a specially crafted file with an affected version of Visual Studio.</p> <p>The update addresses the vulnerability by correcting how Visual Studio handles objects in memory.</p>
Which versions are affected by CVE-2020-16856?
It affects 3 products.
Products include Microsoft Visual Studio, Microsoft Visual Studio 2017, Microsoft Visual Studio 2019.
How do I fix CVE-2020-16856?
No fix has been published for CVE-2020-16856 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2020-16856 being exploited?
There is no known exploitation of CVE-2020-16856 in the wild and no public exploit code.
Other vulnerabilities in Microsoft Visual Studio
- CVE-2025-49739 Visual Studio Elevation of Privilege Vulnerability
- CVE-2022-35777 Visual Studio Remote Code Execution Vulnerability
- CVE-2022-35825 Visual Studio Remote Code Execution Vulnerability
- CVE-2022-35826 Visual Studio Remote Code Execution Vulnerability
- CVE-2022-35827 Visual Studio Remote Code Execution Vulnerability