high · 8.8CVE-2026-71328Sep 9, 2026

CVE-2026-71328: Microsoft.DiaSymReader.Native Heap Buffer Overflow via Malformed MSFZ PDB

Penetration Testing Team Lead, SecureLayer7

A crafted MSFZ-format PDB file can trigger an out-of-bounds heap write inside Microsoft.DiaSymReader.Native, letting an attacker execute arbitrary code on any Windows machine that opens the file.

PackageMicrosoft.DiaSymReader.Native

Ecosystemnuget

Affected>= 17.10.0-beta1.24272.1, <= 18.9.0-beta1.26405.1

Fixed in18.9.0-beta1.26405.2

CVE-2026-71328: Microsoft.DiaSymReader.Native Heap Buffer Overflow via Malformed MSFZ PDB

The problem

Microsoft.DiaSymReader.Native is the native Windows DLL that reads and writes PDB debug-symbol files for .NET tooling, including compilers, debuggers, and crossgen2.

When the library parses an MSFZ-container PDB, it performs an out-of-bounds write on the heap (CWE-122). An attacker who can convince a developer or CI system to open a specially crafted .pdb file triggers the bug remotely. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) scores this 8.8 because no authentication is needed and the only gate is the one click it takes to load symbols.

The fix

Update Microsoft.DiaSymReader.Native to 18.9.0-beta1.26405.2 or later. For .NET 8, 9, 10, and 11 RC1 projects, bump the PackageReference directly:

Alternatively, install the latest .NET SDK or Visual Studio update, which bundles the patched DLL. Restart any affected tooling after updating.

Reported by Reported via Microsoft Security Response Center (MSRC); reporter identity not publicly disclosed (acknowledgement field contains only an MD5 hash: 41ae55e9310ff27fa6f26af4727e5590).

References: [1][2][3][4]

Related research