Executive brief
Microsoft Visual Studio contains a heap buffer overflow bug in a debugging symbol reader component that could allow an attacker to execute malicious code on a developer's machine over the network. This affects the DiaSymReader.Native library used by Visual Studio for parsing debug information. A successful exploit could give an attacker complete control over the affected system, compromising development environments and potentially sensitive source code or intellectual property.
Technical details
This is a heap-based buffer overflow vulnerability (CWE-122) in Microsoft's DiaSymReader.Native component, which is responsible for reading debug symbol information in Visual Studio. The vulnerability can be exploited over a network (AV:N) with low attack complexity (AC:L), requiring no special privileges (PR:N) but does require user interaction (UI:R). An attacker can exploit this to achieve arbitrary code execution with high impact on confidentiality, integrity, and availability. The vulnerable version range is Microsoft.DiaSymReader.Native >= 17.10.0-beta1.24272.1 through <= 18.9.0-beta1.26405.1. Microsoft has released a patch in version 18.9.0-beta1.26405.2. Note: This advisory was withdrawn as a duplicate of GHSA-2j8r-3c22-8565.
Affected products
- Microsoft Microsoft.DiaSymReader.Native >= 17.10.0-beta1.24272.1, <= 18.9.0-beta1.26405.1
Timeline
- 2026-09-08: disclosed
- 2026-09-08: patched: Patch version 18.9.0-beta1.26405.2 released