CVE-2026-69439: Microsoft.DiaSymReader.Native Heap-Based Buffer Overflow
A crafted Portable PDB file can trigger an out-of-bounds heap write in the .NET symbol-reader library, letting an attacker escalate privileges on any Windows machine that loads the file.
The problem
Microsoft.DiaSymReader.Native is a closed-source Windows DLL that reads both Windows PDB and Portable PDB debug symbol files. It is shipped with .NET SDKs, Visual Studio, and any NuGet package that references it.
When the library parses a Portable PDB, a length or count field from the file is used to size or index a heap buffer without sufficient validation. An attacker who can get a victim to open a malicious PDB (for example, by loading debug symbols for a tampered assembly in Visual Studio or a debugger) can trigger an out-of-bounds write on the heap.
The CVSS vector (AV:N/AC:L/PR:N/UI:R) reflects that no special privileges are needed, only user interaction to load the file.
The fix
Update Microsoft.DiaSymReader.Native to 18.9.0-beta1.26405.2 or later in your project file. If you are on .NET 8, 9, 10, or 11 RC1, install the corresponding patched SDK or Visual Studio update that bundles this version. Restart any running build or IDE processes after the update.
Related research
- high · 8.8CVE-2026-69439: Microsoft.DiaSymReader.Native Heap-Based Buffer Overflow (EoP)
- high · 8.8CVE-2026-71328: Microsoft.DiaSymReader.Native Heap-Based Buffer Overflow via Malformed Portable PDB
- high · 8.8CVE-2026-71328CVE-2026-71328: Microsoft.DiaSymReader.Native Heap Buffer Overflow via Malformed MSFZ PDB
- high · 8.8CVE-2026-69522CVE-2026-69522: Microsoft.DiaSymReader.Native Heap-based Buffer Overflow RCE