What is CVE-2025-29803?

CVE-2025-29803 is a security advisory published by Microsoft Security Response Center (MSRC) with High severity. Visual Studio Tools for Applications and SQL Server Management Studio Elevation of Privilege Vulnerability

Which CVE IDs does CVE-2025-29803 cover?

CVE-2025-29803 covers the following CVE IDs: CVE-2025-29803. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of CVE-2025-29803?

CVE-2025-29803 has a CVSS v3 base score of 7.3, published by Microsoft Security Response Center (MSRC).

Which products are affected by CVE-2025-29803?

CVE-2025-29803 affects 5 products, including: SQL Server Management Studio 20.2; VSTA 2019 SDK; VSTA 2022 SDK; Visual Studio Tools for Applications (VSTA) 2019; Visual Studio Tools for Applications (VSTA) 2022.

CVE-2025-29803HighCVSS 7.3

Visual Studio Tools for Applications and SQL Server Management Studio Elevation of Privilege Vulnerability

Vendor

Microsoft Security Response Center (MSRC)

Published

April 8, 2025

Last Modified

—

🔗 CVE IDs covered (1)

CVE-2025-29803 →

📋 Description

Uncontrolled search path element in Visual Studio Tools for Applications and SQL Server Management Studio allows an authorized attacker to elevate privileges locally.

🎯 Affected products5

SQL Server Management Studio 20.2
VSTA 2019 SDK
VSTA 2022 SDK
Visual Studio Tools for Applications (VSTA) 2019
Visual Studio Tools for Applications (VSTA) 2022

✅ Remediation

KBRelease Notes (Security Update) — fixed build 16.0.35907.0 KBRelease Notes (Security Update) — fixed build 17.0.35906.0 KBRelease Notes (Security Update) — fixed build 20.2.37.0

🔗 References (6)

advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29803
patchhttps://www.microsoft.com/en-us/download/details.aspx?id=58317&msockid=25abd48859306f62096bc0a9588a6e01
patchhttps://www.microsoft.com/en-ie/download/details.aspx?id=105123&msockid=25abd48859306f62096bc0a9588a6e01
patchhttps://www.microsoft.com/en-us/download/details.aspx?id=105122&msockid=25abd48859306f62096bc0a9588a6e01
patchhttps://aka.ms/ssmsfullsetup
referencehttps://learn.microsoft.com/en-us/ssms/release-notes-ssms#previous-ssms-releases