CVE-2023-21567 Visual Studio Denial of Service Vulnerability

Medium 5.6 Published 14 Feb 2023 Updated 19 Aug 2026

An attacker can cause a denial of service in Microsoft Visual Studio by exploiting a path traversal vulnerability.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2023-21567?

CVE-2023-21567 is a medium-severity path traversal vulnerability in Microsoft Visual Studio 2017, published on 14 Feb 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Visual Studio Denial of Service Vulnerability

Weakness: CWE-59

Which versions are affected by CVE-2023-21567?

It affects 3 products.

Products include Microsoft Visual Studio 2017, Microsoft Visual Studio 2019, Microsoft Visual Studio 2022.

How do I fix CVE-2023-21567?

No fix has been published for CVE-2023-21567 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2023-21567 being exploited?

There is no known exploitation of CVE-2023-21567 in the wild and no public exploit code.

All Microsoft Visual Studio 2017 vulnerabilities

Sources

Also known as GHSA-9732-m75g-72wh.