CVE-2026-81378: CWE-436: Interpretation Conflict in Microsoft Visual Studio Code

CVE-2026-81378 is an interpretation conflict vulnerability (CWE-436) in Microsoft Visual Studio Code that enables an unauthorized attacker to bypass a security feature remotely. The vulnerability has a CVSS v3.1 base score of 8.2, indicating high severity, with network attack vector, low attack complexity, no privileges required, and user interaction required. The impact includes high confidentiality impact, low integrity impact, and no availability impact. The vulnerability affects Visual Studio Code versions >=1.0.0 and <1.136.2. Microsoft has published an official fix to remediate this issue.

An attacker can remotely bypass a security feature in Visual Studio Code without privileges but requires user interaction. The confidentiality impact is high, potentially exposing sensitive information, while integrity impact is low and availability is unaffected. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft for Visual Studio Code versions affected by this vulnerability. Users and administrators should apply the update to version 1.136.2 or later to remediate this issue. Refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81378 for detailed patching instructions.