CVE-2026-71328: Microsoft.DiaSymReader.Native Heap-Based Buffer Overflow via Malformed Portable PDB
A crafted Portable PDB debug file can trigger a heap buffer overflow in the .NET symbol reader, letting a remote attacker run arbitrary code on any machine that opens or loads the malicious file.
The problem
Microsoft.DiaSymReader.Native versions 17.10.0-beta1.24272.1 through 18.9.0-beta1.26405.1 contain a heap-based buffer overflow (CWE-122) in the Portable PDB parser. An out-of-bounds write occurs when the parser processes certain fields in a crafted .pdb file without proper length validation.
Because Visual Studio, debuggers, and build tooling all open PDB files automatically during normal workflows, an attacker can trigger code execution simply by getting a developer to load a project or binary that references a malicious symbol file. The CVSS vector (AV:N/AC:L/PR:N/UI:R) reflects that no authentication is needed and only a single user interaction, such as opening a project, is required.
The fix
Update Microsoft.DiaSymReader.Native to 18.9.0-beta1.26405.2 or later. For Visual Studio users, install the latest Visual Studio servicing update released September 8, 2026. Restart any running build or debug processes after patching. As a defense-in-depth measure, avoid opening PDB files from untrusted sources in any .NET tooling.
Related research
- high · 8.8CVE-2026-69439: Microsoft.DiaSymReader.Native Heap-Based Buffer Overflow (EoP)
- high · 8.8CVE-2026-71328CVE-2026-71328: Microsoft.DiaSymReader.Native Heap Buffer Overflow via Malformed MSFZ PDB
- high · 8.8CVE-2026-69439CVE-2026-69439: Microsoft.DiaSymReader.Native Heap-Based Buffer Overflow
- high · 8.8CVE-2026-69522CVE-2026-69522: Microsoft.DiaSymReader.Native Heap-based Buffer Overflow RCE