high · 8.8Sep 8, 2026

CVE-2026-69522: Microsoft.DiaSymReader.Native Heap-based Buffer Overflow RCE

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

A heap-based buffer overflow in the native PDB symbol-reader library shipped with .NET and Visual Studio lets a network-reachable attacker execute arbitrary code on any machine that opens a malicious…

PackageMicrosoft.DiaSymReader.Native
Ecosystemnuget
Affected>= 17.10.0-beta1.24272.1, <= 18.9.0-beta1.26405.1
Fixed in18.9.0-beta1.26405.2
CVE-2026-69522: Microsoft.DiaSymReader.Native Heap-based Buffer Overflow RCE

The problem

Microsoft.DiaSymReader.Native is a native Windows DLL (x86, amd64, arm, arm64) that reads and writes Program Database (PDB) symbol files. It is bundled with Visual Studio, MSBuild, and the .NET SDK and is invoked automatically whenever a debugger or build tool loads symbol information.

Versions 17.10.0-beta1.24272.1 through 18.9.0-beta1.26405.1 contain a heap-based buffer overflow (CWE-122) triggered during PDB parsing. An attacker who can deliver a crafted PDB file to a target, such as through a rogue NuGet symbol server, a malicious build artifact feed, or a network share, can achieve remote code execution without any authentication.

CVSS 8.8 reflects network vector, low complexity, and no privileges required.

The fix

Update the NuGet package Microsoft.DiaSymReader.Native to version 18.9.0-beta1.26405.2 or later. Visual Studio users should apply the September 2026 Patch Tuesday update (KB released 2026-09-08) via Windows Update or the Visual Studio installer. .NET SDK users should update to an SDK release that bundles the patched DLL.

Verify the installed DiaSymReader DLL file version after patching.

Reporter not attributed.

References: [1][2][3]

Related research