OpenSSL CVEs Detected in Visual Studio 2022 Git (MinGW) Components

Microsoft Defender for Endpoint (MDE) has detected the following OpenSSL vulnerabilities on one of our servers:

CVE-2025-9231

CVE-2025-9232

Vulnerability details:

Path: C:\Program Files\Microsoft Visual Studio\2022\Professional\Common7\IDE\CommonExtensions\Microsoft\TeamFoundation\Team Explorer\Git\mingw64\bin\libssl-3-x64.dll

Vendor: OpenSSL

Installed version: 3.5.3.0

The affected OpenSSL DLL appears to be bundled with Visual Studio 2022, specifically within the Git (MinGW64) components used by Team Explorer.

Based on guidance found online, I have updated Visual Studio using the Visual Studio Installer multiple times and confirmed that the server is running the latest available version of Visual Studio 2022 Professional. However, the OpenSSL binary listed above does not appear to have been updated, and the vulnerability remains flagged by MDE.

It also does not seem possible to update or remove OpenSSL as a standalone component within Visual Studio.

Could you please advise on the supported and recommended way to remediate this issue?