Executive brief
Microsoft.DiaSymReader.Native is a debugging support library used by .NET development tools and applications to read symbol information from compiled binaries. A flaw in how this library processes debug symbol files (PDB files) allows an attacker to write data beyond the allocated buffer, potentially executing arbitrary code. An attacker could exploit this by sending a malicious PDB file to an application or developer that processes it, gaining full system access without requiring any special privileges.
Technical details
The vulnerability is a heap-based buffer overflow (CWE-122) that occurs during the parsing of PDB (Program Database) files in the Microsoft.DiaSymReader.Native NuGet package. When a specially crafted PDB file is processed, the library fails to properly validate buffer boundaries, resulting in an out-of-bounds write condition. The attack vector is network-based with low complexity and requires user interaction (a user or application must process the malicious PDB file). No privileges are required to trigger the vulnerability. Successful exploitation allows an attacker to read and modify memory, potentially leading to arbitrary code execution with the privileges of the application processing the PDB. Patches are available in version 18.9.0-beta1.26405.2 and later for all affected .NET versions.
Affected products
- Microsoft Microsoft.DiaSymReader.Native >= 17.10.0-beta1.24272.1, <= 18.9.0-beta1.26405.1 (.NET 11 RC1); >= 17.12.0-beta1.24603.5, <= 18.9.0-beta1.26405.1 (.NET 8/9/10)
- Microsoft .NET Framework Supported versions as listed in Microsoft Security Update Guide
- Microsoft .NET 8 with affected Microsoft.DiaSymReader.Native versions
- Microsoft .NET 9 with affected Microsoft.DiaSymReader.Native versions
- Microsoft .NET 10 with affected Microsoft.DiaSymReader.Native versions
- Microsoft .NET 11 RC1 with affected Microsoft.DiaSymReader.Native versions
Timeline
- 2026-09-08: disclosed: Microsoft security advisory published
- 2026-09-09: advisory: GitHub Advisory Database entry created (GHSA-2j8r-3c22-8565)
- 2026-09-08: patched: Patch available: Microsoft.DiaSymReader.Native version 18.9.0-beta1.26405.2 and later; September 2026 .NET Framework security update