CVE-2026-69439: Microsoft.DiaSymReader.Native Heap-Based Buffer Overflow (EoP)
A heap-based buffer overflow in the .NET symbol-reader component lets a network attacker elevate privileges by feeding it a crafted Portable PDB file.
The problem
Microsoft.DiaSymReader.Native (versions 17.10.0-beta1.24272.1 through 18.9.0-beta1.26405.1) contains a heap-based buffer overflow triggered during Portable PDB parsing on Windows.
An out-of-bounds write occurs when the native DLL processes a malformed PDB stream. An attacker who can deliver such a file to a tool or service that reads PDBs (debuggers, profilers, IDE components, CI pipelines) can corrupt heap memory and, on a successful exploitation path, gain elevated privileges over the network.
CVSS 8.8 (High).
The fix
Update Microsoft.DiaSymReader.Native to 18.9.0-beta1.26405.2 or later in your NuGet references. If you consume it transitively through the .NET SDK or Visual Studio, install the September 2026 .NET or Visual Studio servicing update. After updating, restart any processes that loaded the old DLL.
Related research
- high · 8.8CVE-2026-71328: Microsoft.DiaSymReader.Native Heap-Based Buffer Overflow via Malformed Portable PDB
- high · 8.8CVE-2026-71328CVE-2026-71328: Microsoft.DiaSymReader.Native Heap Buffer Overflow via Malformed MSFZ PDB
- high · 8.8CVE-2026-69439CVE-2026-69439: Microsoft.DiaSymReader.Native Heap-Based Buffer Overflow
- high · 8.8CVE-2026-69522CVE-2026-69522: Microsoft.DiaSymReader.Native Heap-based Buffer Overflow RCE