Executive brief
Microsoft.DiaSymReader.Native is a library used by .NET and Visual Studio to read debugging information from Portable PDB files. An out-of-bounds write vulnerability in PDB file parsing can allow an attacker to corrupt memory, potentially leading to code execution or application crash. Exploitation requires a user to open or process a maliciously crafted PDB file.
Technical details
The vulnerability is a heap-based buffer overflow (CWE-122) in Microsoft.DiaSymReader.Native library, which parses Portable PDB (Program Debug Database) files used by .NET and Visual Studio. The out-of-bounds write occurs during PDB file parsing when handling specially crafted input, allowing memory corruption. The attack vector is network-based with low complexity; however, user interaction is required (the user must open or process a malicious PDB file). The CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates high confidentiality, integrity, and availability impact. Patches are available: update Microsoft.DiaSymReader.Native to version 18.9.0-beta1.26405.2 or later, or upgrade to the latest .NET runtime/SDK/Visual Studio.
Affected products
- Microsoft Microsoft.DiaSymReader.Native >= 17.10.0-beta1.24272.1, <= 18.9.0-beta1.26405.1 (patched in 18.9.0-beta1.26405.2+)
- Microsoft .NET 8, 9, 10, 11 RC1
- Microsoft Visual Studio All versions using affected Microsoft.DiaSymReader.Native
Timeline
- 2026-09-08: disclosed: Advisory published by Microsoft
- 2026-09-08: patched: Patch available: Microsoft.DiaSymReader.Native version 18.9.0-beta1.26405.2