This vulnerability, tracked as CVE-2026-47292 and classified under CWE-829, involves the inclusion of functionality from an untrusted control sphere within the Visual Studio Code MSSQL Extension. This flaw enables an attacker with local access to elevate their privileges, potentially gaining high-level control over the system. The CVSS v3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, user interaction required, and impacts to confidentiality, integrity, and availability all rated high. Microsoft has published an official fix for this vulnerability.

An attacker with local access and the ability to trick a user into interacting with malicious content could exploit this vulnerability to elevate privileges, resulting in full compromise of the affected system's confidentiality, integrity, and availability.

An official fix is available from Microsoft. Users and administrators should apply the update provided in the Microsoft security advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47292 to remediate this vulnerability.