# CVE-2026-69522: Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.

Source: https://junglewise.ai/threats/cve-2026-69522-microsoft-diasymreader-native-heap-buffer-overflow-in-pdb  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-08. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-69522 · Severity: high · CVSS 8.8 · Published 2026-09-08

Microsoft.DiaSymReader.Native is a debugging support library used by .NET development tools and applications to read symbol information from compiled binaries. A flaw in how this library processes debug symbol files (PDB files) allows an attacker to write data beyond the allocated buffer, potentially executing arbitrary code. An attacker could exploit this by sending a malicious PDB file to an application or developer that processes it, gaining full system access without requiring any special privileges.

Technologies: [Microsoft .NET 10](https://junglewise.ai/threats/technologies/net-10), [Microsoft .NET 8](https://junglewise.ai/threats/technologies/net-8), [Microsoft .NET 9](https://junglewise.ai/threats/technologies/net-9), [Microsoft .NET Framework](https://junglewise.ai/threats/technologies/net-framework), [Microsoft.DiaSymReader.Native (NuGet)](https://junglewise.ai/threats/technologies/microsoft-diasymreader-native). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft), [NuGet](https://junglewise.ai/threats/vendors/nuget).

## Quick answers

**Is CVE-2026-69522 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-69522 being exploited in the wild.

**How severe is CVE-2026-69522?** High severity, with a CVSS score of 8.8, published 8 September 2026.

**Which products and versions are affected?** Microsoft .NET 10 with affected Microsoft.DiaSymReader.Native versions; Microsoft .NET 11 RC1 with affected Microsoft.DiaSymReader.Native versions; Microsoft .NET 8 with affected Microsoft.DiaSymReader.Native versions; Microsoft .NET 9 with affected Microsoft.DiaSymReader.Native versions; and 2 more.

**Is there a fix for CVE-2026-69522?** Yes. Microsoft.DiaSymReader.Native (NuGet): upgrade to 18.9.0-beta1.26405.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-69522 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-69522?** Check whether you run Microsoft .NET 10, Microsoft .NET 11 RC1, Microsoft .NET 8 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Microsoft.DiaSymReader.Native (NuGet): upgrade to 18.9.0-beta1.26405.2 or later

  ```sh
  dotnet add package Microsoft.DiaSymReader.Native --version 18.9.0-beta1.26405.2
  ```


## Technical details

The vulnerability is a heap-based buffer overflow (CWE-122) that occurs during the parsing of PDB (Program Database) files in the Microsoft.DiaSymReader.Native NuGet package. When a specially crafted PDB file is processed, the library fails to properly validate buffer boundaries, resulting in an out-of-bounds write condition. The attack vector is network-based with low complexity and requires user interaction (a user or application must process the malicious PDB file). No privileges are required to trigger the vulnerability. Successful exploitation allows an attacker to read and modify memory, potentially leading to arbitrary code execution with the privileges of the application processing the PDB. Patches are available in version 18.9.0-beta1.26405.2 and later for all affected .NET versions.

## Affected products

- Microsoft Microsoft.DiaSymReader.Native >= 17.10.0-beta1.24272.1, <= 18.9.0-beta1.26405.1 (.NET 11 RC1); >= 17.12.0-beta1.24603.5, <= 18.9.0-beta1.26405.1 (.NET 8/9/10)
- Microsoft .NET Framework Supported versions as listed in Microsoft Security Update Guide
- Microsoft .NET 8 with affected Microsoft.DiaSymReader.Native versions
- Microsoft .NET 9 with affected Microsoft.DiaSymReader.Native versions
- Microsoft .NET 10 with affected Microsoft.DiaSymReader.Native versions
- Microsoft .NET 11 RC1 with affected Microsoft.DiaSymReader.Native versions

## Identifiers

- CVE-2026-69522
- GHSA-2j8r-3c22-8565

## Timeline

- 2026-09-08: disclosed: Microsoft security advisory published
- 2026-09-09: advisory: GitHub Advisory Database entry created (GHSA-2j8r-3c22-8565)
- 2026-09-08: patched: Patch available: Microsoft.DiaSymReader.Native version 18.9.0-beta1.26405.2 and later; September 2026 .NET Framework security update

## References

- [https://github.com/dotnet/runtime/security/advisories/GHSA-2j8r-3c22-8565](https://github.com/dotnet/runtime/security/advisories/GHSA-2j8r-3c22-8565)
- [https://api.github.com/repos/dotnet/runtime/security-advisories/GHSA-2j8r-3c22-8565](https://api.github.com/repos/dotnet/runtime/security-advisories/GHSA-2j8r-3c22-8565)

## Related threats

- [Microsoft Active Directory Federation Services information disclosure](https://junglewise.ai/threats/cve-2026-97788-observable-discrepancy-in-active-directory-federation-services-ad)
- [Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.](https://junglewise.ai/threats/cve-2026-96960-microsoft-security-advisory-net-and-visual-studio-denial-of)
- [Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.](https://junglewise.ai/threats/cve-2026-96959-microsoft-security-advisory-net-and-visual-studio-denial-of)
- [Microsoft .NET certificate validation bypass in Cryptography.Xml](https://junglewise.ai/threats/cve-2026-96222-microsoft-security-advisory-net-spoofing-vulnerability)
- [.NET Framework untrusted search path security feature bypass](https://junglewise.ai/threats/cve-2026-108398-untrusted-search-path-in-net-framework-allows-an-authorized)