Executive brief
Microsoft DiaSymReader.Native is a library used by .NET and Visual Studio to read debugging symbol information from PDB files. A heap buffer overflow vulnerability allows an attacker to craft a malicious PDB file that, when processed by the library, overwrites memory and executes arbitrary code. This affects developers and CI/CD pipelines that process untrusted or compromised symbol files, potentially leading to code injection and system compromise.
Technical details
This vulnerability is a heap-based buffer overflow (CWE-122) triggered during MSFZ PDB file processing in Microsoft.DiaSymReader.Native. The root cause is insufficient bounds checking when writing to heap-allocated buffers. Attack vector is network-based (AV:N) with low complexity (AC:L), requiring only user interaction (UI:R) such as opening a project with a malicious PDB file or fetching symbols from an untrusted source. No privileges are required. A successful exploit enables arbitrary code execution in the context of the affected application or development environment. The vulnerability impacts .NET 8, 9, 10, and 11 RC1. Patches are available: update Microsoft.DiaSymReader.Native to version 18.9.0-beta1.26405.2 or later, or upgrade to the latest .NET SDK/Visual Studio.
Affected products
- Microsoft Microsoft.DiaSymReader.Native >= 17.10.0-beta1.24272.1, <= 18.9.0-beta1.26405.1
- Microsoft .NET 11 RC1 uses affected Microsoft.DiaSymReader.Native
- Microsoft .NET 10 uses affected Microsoft.DiaSymReader.Native
- Microsoft .NET 9 uses affected Microsoft.DiaSymReader.Native
- Microsoft .NET 8 uses affected Microsoft.DiaSymReader.Native
- Microsoft Visual Studio versions using affected Microsoft.DiaSymReader.Native
Timeline
- 2026-09-08: disclosed: Microsoft security advisory published
- 2026-09-08: patched: Patch released: Microsoft.DiaSymReader.Native version 18.9.0-beta1.26405.2