CVE-2026-114158

Name of the Vulnerable Software and Affected Versions .NET on Windows versions 8.0.0 through 8.0.33 .NET on Windows versions 9.0.0 through 9.0.22 .NET on Windows versions 10.0.0 through 10.0.14 .NET on Windows versions 11.0.0-preview.1 through 11.0.0-preview.x Microsoft.NETCore.App.Runtime.win-x86 versions 8.0.0 through 8.0.33 Microsoft.NETCore.App.Runtime.win-x64 versions 8.0.0 through 8.0.33 Microsoft.NETCore.App.Runtime.win-arm64 versions 8.0.0 through 8.0.33 Microsoft.NETCore.App.Runtime.win-x86 versions 9.0.0 through 9.0.22 Microsoft.NETCore.App.Runtime.win-x64 versions 9.0.0 through 9.0.22 Microsoft.NETCore.App.Runtime.win-arm64 versions 9.0.0 through 9.0.22 Microsoft.NETCore.App.Runtime.win-x86 versions 10.0.0 through 10.0.14 Microsoft.NETCore.App.Runtime.win-x64 versions 10.0.0 through 10.0.14 Microsoft.NETCore.App.Runtime.win-arm64 versions 10.0.0 through 10.0.14 Microsoft.NETCore.App.Runtime.win-x86 versions 11.0.0-preview.1 through 11.0.0-preview.x Microsoft.NETCore.App.Runtime.win-x64 versions 11.0.0-preview.1 through 11.0.0-preview.x Microsoft.NETCore.App.Runtime.win-arm64 versions 11.0.0-preview.1 through 11.0.0-preview.x .NET SDK 8.0.1xx on Windows versions 8.0.100-0 through 8.0.133 .NET SDK 8.0.4xx on Windows versions 8.0.400-0 through 8.0.427 .NET SDK 9.0.1xx on Windows versions 9.0.100-0 through 9.0.123 .NET SDK 9.0.3xx on Windows versions 9.0.300-0 through 9.0.320 .NET SDK 10.0.1xx on Windows versions 10.0.100-0 through 10.0.114 .NET SDK 10.0.4xx on Windows versions 10.0.400-0 through 10.0.403 .NET SDK 11.0.1xx on Windows versions 11.0.100-preview.1 through 11.0.99

Description A heap-based buffer overflow exists in Visual Studio and .NET that allows an unauthorized attacker to execute code over a network. The issue occurs in the Microsoft.DiaSymReader.Native components when initializing the native reader with a crafted Portable PDB containing an EmbeddedSource record with parent RID 0, which triggers an out-of-bounds write. This initialization can be reached via the Windows runtime native stack-trace reader through its native-reader fallback.

Recommendations Update .NET on Windows to version 8.0.34, 9.0.23, 10.0.15, or 11.0.0 respectively. Update Microsoft.NETCore.App.Runtime.win-x86, win-x64, and win-arm64 to version 8.0.34, 9.0.23, 10.0.15, or 11.0.0 respectively. Update .NET SDK 8.0.1xx on Windows to version 8.0.134. Update .NET SDK 8.0.4xx on Windows to version 8.0.428. Update .NET SDK 9.0.1xx on Windows to version 9.0.124. Update .NET SDK 9.0.3xx on Windows to version 9.0.321. Update .NET SDK 10.0.1xx on Windows to version 10.0.115. Update .NET SDK 10.0.4xx on Windows to version 10.0.404. Update .NET SDK 11.0.1xx on Windows to version 11.0.100. For self-contained applications, update the runtime used to build the application, rebuild, and redeploy. Restart processes that have loaded the affected native reader.