CVE-2026-69522: Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.

CVE-2026-69522 · Severity: high · CVSS 8.8 · Published 2026-09-08

Microsoft.DiaSymReader.Native is a debugging support library used by .NET development tools and applications to read symbol information from compiled binaries. A flaw in how this library processes debug symbol files (PDB files) allows an attacker to write data beyond the allocated buffer, potentially executing arbitrary code. An attacker could exploit this by sending a malicious PDB file to an application or developer that processes it, gaining full system access without requiring any special privileges.

Technologies: Microsoft .NET 10, Microsoft .NET 8, Microsoft .NET 9, Microsoft .NET Framework, Microsoft.DiaSymReader.Native (NuGet). Vendors: Microsoft, NuGet.

Quick answers

Is CVE-2026-69522 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-69522 being exploited in the wild.
How severe is CVE-2026-69522?
High severity, with a CVSS score of 8.8, published 8 September 2026.
Which products and versions are affected?
Microsoft .NET 10 with affected Microsoft.DiaSymReader.Native versions; Microsoft .NET 11 RC1 with affected Microsoft.DiaSymReader.Native versions; Microsoft .NET 8 with affected Microsoft.DiaSymReader.Native versions; Microsoft .NET 9 with affected Microsoft.DiaSymReader.Native versions; and 2 more.
Is there a fix for CVE-2026-69522?
Yes. Microsoft.DiaSymReader.Native (NuGet): upgrade to 18.9.0-beta1.26405.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-69522 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-69522?
Check whether you run Microsoft .NET 10, Microsoft .NET 11 RC1, Microsoft .NET 8 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Microsoft.DiaSymReader.Native (NuGet): upgrade to 18.9.0-beta1.26405.2 or later
    dotnet add package Microsoft.DiaSymReader.Native --version 18.9.0-beta1.26405.2

Technical details

The vulnerability is a heap-based buffer overflow (CWE-122) that occurs during the parsing of PDB (Program Database) files in the Microsoft.DiaSymReader.Native NuGet package. When a specially crafted PDB file is processed, the library fails to properly validate buffer boundaries, resulting in an out-of-bounds write condition. The attack vector is network-based with low complexity and requires user interaction (a user or application must process the malicious PDB file). No privileges are required to trigger the vulnerability. Successful exploitation allows an attacker to read and modify memory, potentially leading to arbitrary code execution with the privileges of the application processing the PDB. Patches are available in version 18.9.0-beta1.26405.2 and later for all affected .NET versions.

Affected products

  • Microsoft Microsoft.DiaSymReader.Native >= 17.10.0-beta1.24272.1, <= 18.9.0-beta1.26405.1 (.NET 11 RC1); >= 17.12.0-beta1.24603.5, <= 18.9.0-beta1.26405.1 (.NET 8/9/10)
  • Microsoft .NET Framework Supported versions as listed in Microsoft Security Update Guide
  • Microsoft .NET 8 with affected Microsoft.DiaSymReader.Native versions
  • Microsoft .NET 9 with affected Microsoft.DiaSymReader.Native versions
  • Microsoft .NET 10 with affected Microsoft.DiaSymReader.Native versions
  • Microsoft .NET 11 RC1 with affected Microsoft.DiaSymReader.Native versions

Identifiers

  • CVE-2026-69522
  • GHSA-2j8r-3c22-8565

Timeline

  • 2026-09-08: disclosed: Microsoft security advisory published
  • 2026-09-09: advisory: GitHub Advisory Database entry created (GHSA-2j8r-3c22-8565)
  • 2026-09-08: patched: Patch available: Microsoft.DiaSymReader.Native version 18.9.0-beta1.26405.2 and later; September 2026 .NET Framework security update

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.