DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-114152: CVE-2026-114152: Stack-Based Buffer Overflow and Untrusted Pointer Dereference in Microsoft DiaSymReader.Native

#security #cve #cybersecurity

CVE-2026-114152: Stack-Based Buffer Overflow and Untrusted Pointer Dereference in Microsoft DiaSymReader.Native

Vulnerability ID: CVE-2026-114152
CVSS Score: 8.8
Published: 2026-11-11

CVE-2026-114152 is a high-severity remote code execution vulnerability affecting Microsoft Visual Studio 2026 and multiple servicing branches of the Microsoft .NET runtime (.NET 8.0, 9.0, 10.0, and 11.0) on Windows platforms. The vulnerability exists within the native symbol reader library, Microsoft.DiaSymReader.Native, specifically inside the DiaObjectFile::ApplyFixup method during the processing of Common Object File Format (COFF) relocation records. By supplying a malformed object file or Program Database (PDB) symbol file containing out-of-bounds relocation offsets or invalid symbol table indices, an unauthenticated attacker can trigger an untrusted pointer dereference (CWE-822) and a stack-based buffer overflow (CWE-121). Successful exploitation occurs when a victim opens, compiles, or debugs a malicious project or symbol artifact, leading to arbitrary code execution within the security context of the active developer environment or build process.

TL;DR

A stack-based buffer overflow (CWE-121) and untrusted pointer dereference (CWE-822) in Microsoft.DiaSymReader.Native (DiaObjectFile::ApplyFixup) allows remote code execution when Visual Studio 2026 or .NET 8/9/10/11 on Windows parses malformed COFF relocations in debug symbol or object files.

Technical Details

  • Vulnerability ID: CVE-2026-114152
  • Weakness Class: CWE-121 (Stack-based Buffer Overflow) & CWE-822 (Untrusted Pointer Dereference)
  • Vulnerable Component: Microsoft.DiaSymReader.Native (DiaObjectFile::ApplyFixup)
  • Attack Vector: Network (AV:N) via Malformed COFF / PDB Symbol Files
  • CVSS v3.1 Score: 8.8 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
  • Impact: Arbitrary Remote Code Execution in Visual Studio / .NET Context
  • Exploit Status: Unproven / No Public PoC
  • CISA KEV Status: Not Listed

Affected Systems

  • Microsoft Visual Studio 2026 on Windows
  • Microsoft .NET 8.0 on Windows
  • Microsoft .NET 9.0 on Windows
  • Microsoft .NET 10.0 on Windows
  • Microsoft .NET 11.0 on Windows
  • Visual Studio 2026: >= 18.12, < 18.12.0 (Fixed in: 18.12.0)
  • .NET 8.0 (Windows): >= 8.0.0, < 8.0.34 (Fixed in: 8.0.34)
  • .NET 9.0 (Windows): >= 9.0.0, < 9.0.23 (Fixed in: 9.0.23)
  • .NET 10.0 (Windows): >= 10.0.0, < 10.0.15 (Fixed in: 10.0.15)
  • .NET 11.0 (Windows): >= 11.0.0-preview.1, < 11.0.0 (Fixed in: 11.0.0)

Mitigation Strategies

  • Upgrade Microsoft Visual Studio 2026 and all Windows .NET SDK/Runtime installations (.NET 8.0, 9.0, 10.0, and 11.0) to their respective November 2026 patched versions.
  • Configure Visual Studio Trust Settings to require Restricted Mode when opening repositories, solutions, or project folders originating from untrusted sources.
  • Disable automatic loading of debug symbols (.pdb) from local output folders or untrusted symbol servers within Visual Studio debugging options.
  • Isolate CI/CD build pipelines using ephemeral environments and restrict automated execution of 'dotnet test' or 'dotnet build' on untrusted external pull requests.

Remediation Steps:

  1. Inventory all Windows developer workstations, CI/CD build agents, and servers running Microsoft Visual Studio 2026 or .NET 8.0, 9.0, 10.0, and 11.0.
  2. Apply the Visual Studio 2026 v18.12.0 update via the Visual Studio Installer or Microsoft Endpoint Configuration Manager.
  3. Download and install the patched .NET SDK and Runtime installers for Windows: .NET 8.0.34, .NET 9.0.23, .NET 10.0.15, and .NET 11.0.0.
  4. Audit internal projects and build tools for standalone NuGet references to Microsoft.DiaSymReader.Native and update them to the patched package versions.
  5. Restart active Visual Studio instances, MSBuild worker nodes, and .NET host processes to ensure the updated Microsoft.DiaSymReader.Native.dll binary is loaded into memory.

References

Read the full report for CVE-2026-114152 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)