CVE-2026-81376: CWE-1023: Incomplete Comparison with Missing Factors in Microsoft Visual Studio Code

This vulnerability (CVE-2026-81376) in Microsoft Visual Studio Code is due to an incomplete comparison with missing factors, categorized under CWE-1023. It enables an unauthorized attacker to bypass a security feature remotely, potentially leading to complete compromise of confidentiality, integrity, and availability of the affected system. The CVSS 3.1 base score is 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and scope change with high impact on all security properties. The vulnerability affects Visual Studio Code versions 1.0.0 and all versions from 1.0.0 up to but excluding 1.136.2. Microsoft has released an official fix, and users are advised to update to a patched version. No exploits have been observed in the wild as of the publication date.

Successful exploitation allows an unauthorized attacker to bypass a security feature remotely, resulting in complete compromise of confidentiality, integrity, and availability of the affected Visual Studio Code environment. This could lead to unauthorized access and control over the system or data processed by the application.

An official fix is available from Microsoft. Users should update Visual Studio Code to version 1.136.2 or later to remediate this vulnerability. Since the vendor advisory confirms an official fix, applying the update is the recommended mitigation. No additional actions are specified or required beyond applying the official patch.