Information disclosure vulnerability

An information disclosure vulnerability exists in VS Code 1.132.0 and earlier versions where malicious extension and webview contents could read sensitive data from reused internal buffers.

Patches

The fix is available starting with VS Code 1.132.1. The fix (ae7a280) mitigates this attack by copying the intended range of the internal buffer contents before sending to extensions.

References

• The patch for this can be found at ae7a280
• An issue for this can be found at #330306
• MSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47285