Analysis Summary

CVE-2025-29817 CVSS:5.7

Microsoft Power Automate Desktop could allow a remote authenticated attacker to obtain sensitive information, cause by an uncontrolled search path element vulnerability. An attacker could exploit this vulnerability to disclose information over a network.

CVE-2025-32726 CVSS:6.8

Microsoft Visual Studio Code could allow a local authenticated attacker to gain elevated privileges on the system, caused by an improper access control vulnerability. An attacker could exploit this vulnerability to gain elevated privileges on the system.

Impact

• Information Disclosure
• Privilege Escalation

Indicators of Compromise

CVE

• CVE-2025-29817

• CVE-2025-32726

Affected Vendors

Remediation

Use Microsoft Automatic Update to apply the appropriate patch for your system, or the Microsoft Security Update Guide to search for available patches.

CVE-2025-29817

CVE-2025-32726