CVE-2026-81383: CWE-706: Use of Incorrectly-Resolved Name or Reference in Microsoft Visual Studio Code

This vulnerability (CWE-706) in Visual Studio Code involves the use of an incorrectly-resolved name or reference, which can be exploited by an unauthorized attacker to disclose sensitive information over a network. The flaw affects versions >=1.0.0 and <1.136.2. The CVSS 3.1 base score is 7.4, indicating high severity, with network attack vector, low attack complexity, no privileges required, and user interaction required. The impact is confidentiality loss only, with no integrity or availability impact. Microsoft has published an official fix for this vulnerability.

An attacker can exploit this vulnerability to disclose sensitive information over a network without requiring privileges, potentially leading to exposure of confidential data. There is no impact on integrity or availability. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users should apply the update to Visual Studio Code version 1.136.2 or later to remediate this vulnerability. Refer to the Microsoft security advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81383 for detailed patch information.