Microsoft .NET and Visual Studio heap buffer overflow elevation of privilege

Severity: high · CVSS 8.8 · Published 2026-09-08

.NET and Visual Studio are core development platforms used by organizations to build and run applications. A heap buffer overflow vulnerability in the DiaSymReader component allows attackers to escalate privileges on networked systems, potentially gaining full control of affected machines. An attacker can exploit this flaw remotely by tricking a user into interacting with a malicious input, leading to unauthorized access and potential data compromise or system takeover.

Technologies: Microsoft DiaSymReader.Native, Microsoft Visual Studio, Microsoft.DiaSymReader.Native (NuGet). Vendors: Microsoft, NuGet.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
High severity, with a CVSS score of 8.8, published 8 September 2026.
Which products and versions are affected?
Microsoft DiaSymReader.Native 17.10.0-beta1.24272.1 through 18.9.0-beta1.26405.1; Microsoft Visual Studio affected versions correspond to included .NET runtime; Microsoft.DiaSymReader.Native (NuGet) >= 17.10.0-beta1.24272.1, <= 18.9.0-beta1.26405.1.
Is there a fix for This vulnerability?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is This vulnerability attacked?
It is attacked over the network, in a software library.
Am I affected?
Check whether you run Microsoft DiaSymReader.Native, Microsoft Visual Studio or Microsoft.DiaSymReader.Native (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a heap-based buffer overflow vulnerability (CWE-122) in the Microsoft.DiaSymReader.Native component of .NET and Visual Studio. The flaw resides in dynamic symbol reader functionality used for debugging and symbol resolution. The attack vector is network-based and requires user interaction (UI:R), with no elevated privileges needed for exploitation (PR:N). A successful exploit allows an attacker to read, modify, and disrupt system availability (C:H/I:H/A:H), resulting in elevation of privilege. The vulnerability affects versions from 17.10.0-beta1.24272.1 through 18.9.0-beta1.26405.1; patch version 18.9.0-beta1.26405.2 is available.

Affected products

  • Microsoft .NET 17.10.0-beta1.24272.1 through 18.9.0-beta1.26405.1
  • Microsoft Visual Studio affected versions correspond to included .NET runtime
  • Microsoft Microsoft.DiaSymReader.Native 17.10.0-beta1.24272.1 through 18.9.0-beta1.26405.1

Timeline

  • 2026-09-08: disclosed: Published to NVD and GitHub Advisory Database
  • 2026-09-09: advisory: Advisory withdrawn as duplicate of GHSA-527h-q9f6-p7qx

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.