CVE-2026-114152

Name of the Vulnerable Software and Affected Versions Microsoft.DiaSymReader.Native versions prior to 18.9.1-beta1.26515.1 .NET 8.0 installed on Windows versions 8.0.0 through 8.0.33 .NET 9.0 installed on Windows versions 9.0.0 through 9.0.22 .NET 10.0 installed on Windows versions 10.0.0 through 10.0.14 .NET 11.0 installed on Windows versions 11.0.0-preview.1 through 11.0.0-preview.x Microsoft.NETCore.App.Runtime.win-x86 versions 8.0.0 through 8.0.33 Microsoft.NETCore.App.Runtime.win-x64 versions 8.0.0 through 8.0.33 Microsoft.NETCore.App.Runtime.win-arm64 versions 8.0.0 through 8.0.33 Microsoft.NETCore.App.Runtime.win-x86 versions 9.0.0 through 9.0.22 Microsoft.NETCore.App.Runtime.win-x64 versions 9.0.0 through 9.0.22 Microsoft.NETCore.App.Runtime.win-arm64 versions 9.0.0 through 9.0.22 Microsoft.NETCore.App.Runtime.win-x86 versions 10.0.0 through 10.0.14 Microsoft.NETCore.App.Runtime.win-x64 versions 10.0.0 through 10.0.14 Microsoft.NETCore.App.Runtime.win-arm64 versions 10.0.0 through 10.0.14 Microsoft.NETCore.App.Runtime.win-x86 versions 11.0.0-preview.1 through 11.0.0-preview.x Microsoft.NETCore.App.Runtime.win-x64 versions 11.0.0-preview.1 through 11.0.0-preview.x Microsoft.NETCore.App.Runtime.win-arm64 versions 11.0.0-preview.1 through 11.0.0-preview.x .NET SDK 8.0.1xx versions 8.0.100-0 through 8.0.133 .NET SDK 8.0.4xx versions 8.0.400-0 through 8.0.427 .NET SDK 9.0.1xx versions 9.0.100-0 through 9.0.123 .NET SDK 9.0.3xx versions 9.0.300-0 through 9.0.320 .NET SDK 10.0.1xx versions 10.0.100-0 through 10.0.114 .NET SDK 10.0.4xx versions 10.0.400-0 through 10.0.403 .NET SDK 11.0.1xx versions 11.0.100-preview.1 through 11.0.99

Description A stack-based buffer overflow exists in Visual Studio and .NET that allows an unauthorized attacker to execute code over a network. The issue occurs when loading document specifications from a PDB (Program Database) that references an attacker-influenced COFF (Common Object File Format) object. Specifically, attacker-controlled COFF relocation offsets can cause an out-of-bounds stack write in the DiaObjectFile::ApplyFixup() function.

Recommendations Update Microsoft.DiaSymReader.Native to version 18.9.1-beta1.26515.1 or later. Update .NET 8.0 installed on Windows to version 8.0.34 or later. Update .NET 9.0 installed on Windows to version 9.0.23 or later. Update .NET 10.0 installed on Windows to version 10.0.15 or later. Update .NET 11.0 installed on Windows to version 11.0.0 or later. Update Microsoft.NETCore.App.Runtime.win-x86, win-x64, and win-arm64 for .NET 8.0 to version 8.0.34 or later. Update Microsoft.NETCore.App.Runtime.win-x86, win-x64, and win-arm64 for .NET 9.0 to version 9.0.23 or later. Update Microsoft.NETCore.App.Runtime.win-x86, win-x64, and win-arm64 for .NET 10.0 to version 10.0.15 or later. Update Microsoft.NETCore.App.Runtime.win-x86, win-x64, and win-arm64 for .NET 11.0 to version 11.0.0 or later. Update .NET SDK 8.0.1xx to version 8.0.134 or later. Update .NET SDK 8.0.4xx to version 8.0.428 or later. Update .NET SDK 9.0.1xx to version 9.0.124 or later. Update .NET SDK 9.0.3xx to version 9.0.321 or later. Update .NET SDK 10.0.1xx to version 10.0.115 or later. Update .NET SDK 10.0.4xx to version 10.0.404 or later. Update .NET SDK 11.0.1xx to version 11.0.100 or later. For applications deploying their own .NET runtime, update the runtime used to build the application, rebuild, and redeploy. Restart processes that have loaded the affected native reader.