# CVE-2026-69439: Heap-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.

Source: https://junglewise.ai/threats/cve-2026-69439-microsoft-diasymreader-native-heap-overflow-in-pdb-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-08. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-69439 · Severity: high · CVSS 8.8 · Published 2026-09-08

Microsoft.DiaSymReader.Native is a library used by .NET and Visual Studio to read debugging information from Portable PDB files. An out-of-bounds write vulnerability in PDB file parsing can allow an attacker to corrupt memory, potentially leading to code execution or application crash. Exploitation requires a user to open or process a maliciously crafted PDB file.

Technologies: [Microsoft Visual Studio](https://junglewise.ai/threats/technologies/visual-studio), [Microsoft.DiaSymReader.Native (NuGet)](https://junglewise.ai/threats/technologies/microsoft-diasymreader-native). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft), [NuGet](https://junglewise.ai/threats/vendors/nuget).

## Quick answers

**Is CVE-2026-69439 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-69439 being exploited in the wild.

**How severe is CVE-2026-69439?** High severity, with a CVSS score of 8.8, published 8 September 2026.

**Which products and versions are affected?** Microsoft Visual Studio All versions using affected Microsoft.DiaSymReader.Native; Microsoft.DiaSymReader.Native (NuGet) >= 17.10.0-beta1.24272.1, <= 18.9.0-beta1.26405.1, ECOSYSTEM:introduced=17.10.0-beta1.24272.1,fixed=18.9.0-beta1.26405.2.

**Is there a fix for CVE-2026-69439?** Yes. Microsoft.DiaSymReader.Native (NuGet): upgrade to 18.9.0-beta1.26405.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-69439 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-69439?** Check whether you run Microsoft Visual Studio or Microsoft.DiaSymReader.Native (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Microsoft.DiaSymReader.Native (NuGet): upgrade to 18.9.0-beta1.26405.2 or later

  ```sh
  dotnet add package Microsoft.DiaSymReader.Native --version 18.9.0-beta1.26405.2
  ```


## Technical details

The vulnerability is a heap-based buffer overflow (CWE-122) in Microsoft.DiaSymReader.Native library, which parses Portable PDB (Program Debug Database) files used by .NET and Visual Studio. The out-of-bounds write occurs during PDB file parsing when handling specially crafted input, allowing memory corruption. The attack vector is network-based with low complexity; however, user interaction is required (the user must open or process a malicious PDB file). The CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates high confidentiality, integrity, and availability impact. Patches are available: update Microsoft.DiaSymReader.Native to version 18.9.0-beta1.26405.2 or later, or upgrade to the latest .NET runtime/SDK/Visual Studio.

## Affected products

- Microsoft Microsoft.DiaSymReader.Native >= 17.10.0-beta1.24272.1, <= 18.9.0-beta1.26405.1 (patched in 18.9.0-beta1.26405.2+)
- Microsoft .NET 8, 9, 10, 11 RC1
- Microsoft Visual Studio All versions using affected Microsoft.DiaSymReader.Native

## Identifiers

- CVE-2026-69439
- GHSA-527h-q9f6-p7qx

## Timeline

- 2026-09-08: disclosed: Advisory published by Microsoft
- 2026-09-08: patched: Patch available: Microsoft.DiaSymReader.Native version 18.9.0-beta1.26405.2

## References

- [https://github.com/dotnet/runtime/security/advisories/GHSA-527h-q9f6-p7qx](https://github.com/dotnet/runtime/security/advisories/GHSA-527h-q9f6-p7qx)
- [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69439](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69439)
- [https://api.github.com/repos/dotnet/runtime/security-advisories/GHSA-527h-q9f6-p7qx](https://api.github.com/repos/dotnet/runtime/security-advisories/GHSA-527h-q9f6-p7qx)

## Related threats

- [Microsoft Visual Studio heap buffer overflow RCE](https://junglewise.ai/threats/duplicate-advisory-microsoft-security-advisory-visual-studio-remote-224be73b)
- [Microsoft Visual Studio heap-based buffer overflow](https://junglewise.ai/threats/duplicate-advisory-microsoft-security-advisory-visual-studio-remote-6a4b9d28)
- [Microsoft Visual Studio deserialization remote code execution](https://junglewise.ai/threats/duplicate-advisory-microsoft-security-advisory-visual-studio-remote-1eb2f932)
- [Microsoft Visual Studio stack-based buffer overflow](https://junglewise.ai/threats/duplicate-advisory-microsoft-security-advisory-visual-studio-remote-d956164d)
- [Microsoft Visual Studio heap buffer overflow RCE](https://junglewise.ai/threats/cve-2026-118745-heap-based-buffer-overflow-in-visual-studio-allows-an)