Sensitive-data disclosure via reused buffers

Information disclosure in Microsoft Visual Studio Code before 1.132.1 allows remote attackers to read sensitive data via malicious extension or webview content. The vulnerable extension and webview data path reused internal buffers and exposed stale contents because it sent buffer-backed data onward without first copying only the intended range. Exploitation requires delivery of attacker-controlled extension or webview content to a user, and the disclosed data is bounded to sensitive bytes left in those reused buffers rather than arbitrary file read or code execution.