CVE-2026-69439: Heap-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-69439 · Severity: high · CVSS 8.8 · Published 2026-09-08

Microsoft.DiaSymReader.Native is a library used by .NET and Visual Studio to read debugging information from Portable PDB files. An out-of-bounds write vulnerability in PDB file parsing can allow an attacker to corrupt memory, potentially leading to code execution or application crash. Exploitation requires a user to open or process a maliciously crafted PDB file.

Technologies: Microsoft Visual Studio, Microsoft.DiaSymReader.Native (NuGet). Vendors: Microsoft, NuGet.

Quick answers

Is CVE-2026-69439 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-69439 being exploited in the wild.
How severe is CVE-2026-69439?
High severity, with a CVSS score of 8.8, published 8 September 2026.
Which products and versions are affected?
Microsoft Visual Studio All versions using affected Microsoft.DiaSymReader.Native; Microsoft.DiaSymReader.Native (NuGet) >= 17.10.0-beta1.24272.1, <= 18.9.0-beta1.26405.1, ECOSYSTEM:introduced=17.10.0-beta1.24272.1,fixed=18.9.0-beta1.26405.2.
Is there a fix for CVE-2026-69439?
Yes. Microsoft.DiaSymReader.Native (NuGet): upgrade to 18.9.0-beta1.26405.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-69439 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-69439?
Check whether you run Microsoft Visual Studio or Microsoft.DiaSymReader.Native (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Microsoft.DiaSymReader.Native (NuGet): upgrade to 18.9.0-beta1.26405.2 or later
    dotnet add package Microsoft.DiaSymReader.Native --version 18.9.0-beta1.26405.2

Technical details

The vulnerability is a heap-based buffer overflow (CWE-122) in Microsoft.DiaSymReader.Native library, which parses Portable PDB (Program Debug Database) files used by .NET and Visual Studio. The out-of-bounds write occurs during PDB file parsing when handling specially crafted input, allowing memory corruption. The attack vector is network-based with low complexity; however, user interaction is required (the user must open or process a malicious PDB file). The CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates high confidentiality, integrity, and availability impact. Patches are available: update Microsoft.DiaSymReader.Native to version 18.9.0-beta1.26405.2 or later, or upgrade to the latest .NET runtime/SDK/Visual Studio.

Affected products

  • Microsoft Microsoft.DiaSymReader.Native >= 17.10.0-beta1.24272.1, <= 18.9.0-beta1.26405.1 (patched in 18.9.0-beta1.26405.2+)
  • Microsoft .NET 8, 9, 10, 11 RC1
  • Microsoft Visual Studio All versions using affected Microsoft.DiaSymReader.Native

Identifiers

  • CVE-2026-69439
  • GHSA-527h-q9f6-p7qx

Timeline

  • 2026-09-08: disclosed: Advisory published by Microsoft
  • 2026-09-08: patched: Patch available: Microsoft.DiaSymReader.Native version 18.9.0-beta1.26405.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.