CVE-2026-69522: Microsoft.DiaSymReader.Native Heap-based Buffer Overflow RCE
A heap-based buffer overflow in the .NET PDB reader lets an attacker trigger remote code execution by supplying a crafted PDB file to any application that loads debug symbols.
The problem
Microsoft.DiaSymReader.Native contains a heap-based buffer overflow (CWE-122) in its PDB parsing logic. An out-of-bounds write can occur when the native DLL processes a malformed PDB file, corrupting heap memory in the calling process.
Because PDB files are routinely loaded by debuggers, IDEs, profilers, and build tooling, any Windows application that reads symbol information from an attacker-controlled file is within the attack surface. The CVSS vector (AV:N/AC:L/PR:N/UI:R) means a victim only needs to open or load a weaponised PDB, for example via a debugger, a crash-reporting tool, or a package that auto-loads symbols.
The fix
Update Microsoft.DiaSymReader.Native to 18.9.0-beta1.26405.2 or later. For .NET Framework projects, install the September 2026 .NET Framework security update for your Windows version. Restart any process that loads PDB files after patching.
Related research
- high · 8.8CVE-2026-69439: Microsoft.DiaSymReader.Native Heap-Based Buffer Overflow (EoP)
- high · 8.8CVE-2026-71328: Microsoft.DiaSymReader.Native Heap-Based Buffer Overflow via Malformed Portable PDB
- high · 8.8CVE-2026-71328CVE-2026-71328: Microsoft.DiaSymReader.Native Heap Buffer Overflow via Malformed MSFZ PDB
- high · 8.8CVE-2026-69439CVE-2026-69439: Microsoft.DiaSymReader.Native Heap-Based Buffer Overflow