DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-114158: CVE-2026-114158: Heap-Based Buffer Overflow in Microsoft.DiaSymReader.Native Portable PDB Parser

#security #cve #cybersecurity

CVE-2026-114158: Heap-Based Buffer Overflow in Microsoft.DiaSymReader.Native Portable PDB Parser

Vulnerability ID: CVE-2026-114158
CVSS Score: 8.8
Published: 2026-11-11

CVE-2026-114158 is a high-severity remote code execution vulnerability affecting Microsoft Visual Studio 2026 and multiple supported servicing branches of Microsoft .NET (.NET 8.0, 9.0, 10.0, and 11.0) on Windows. The flaw resides in the native symbol reader library, Microsoft.DiaSymReader.Native, and is triggered when parsing Portable Program Database (PDB) metadata containing malformed EmbeddedSource custom debug information records. By supplying a parent Record Identifier (RID) of zero or an out-of-bounds value, an attacker causes an integer underflow during 1-based to 0-based index conversion, leading to a heap-based buffer overflow and arbitrary code execution within the context of the host developer tool or runtime.

TL;DR

A heap-based buffer overflow (CWE-122) in Microsoft.DiaSymReader.Native allows remote code execution when Visual Studio 2026 or .NET (8.0–11.0) parses a crafted Portable PDB file containing a malformed EmbeddedSource record with an invalid parent Record Identifier (RID).

Technical Details

  • CVE ID: CVE-2026-114158
  • Vulnerability Class: CWE-122: Heap-based Buffer Overflow
  • Vulnerable Component: Microsoft.DiaSymReader.Native (Portable PDB Parser)
  • CVSS v3.1 Score: 8.8 High (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
  • Impact: Arbitrary Code Execution in the context of the current user
  • Exploit Status: Unproven (No public PoCs or active exploitation)
  • CISA KEV Status: Not Listed

Affected Systems

  • Microsoft .NET 8.0 on Windows
  • Microsoft .NET 9.0 on Windows
  • Microsoft .NET 10.0 on Windows
  • Microsoft .NET 11.0 on Windows
  • Microsoft Visual Studio 2026 v18.11 on Windows
  • Microsoft Visual Studio 2026 v18.12 on Windows
  • .NET 8.0: >= 8.0.0, < 8.0.34 (Fixed in: 8.0.34)
  • .NET 9.0: >= 9.0.0, < 9.0.23 (Fixed in: 9.0.23)
  • .NET 10.0: >= 10.0.0, < 10.0.15 (Fixed in: 10.0.15)
  • .NET 11.0: >= 11.0.0-preview.1, < 11.0.0 (Fixed in: 11.0.0)
  • Visual Studio 2026 (v18.11): >= 18.11.0, < 18.11.4 (Fixed in: 18.11.4)
  • Visual Studio 2026 (v18.12): < 18.12.0 (Fixed in: 18.12.0)

Mitigation Strategies

  • Upgrade all affected .NET SDKs, runtimes, and Visual Studio 2026 installations to the latest patched servicing releases.
  • Restrict automatic symbol loading in Visual Studio to trusted internal symbol servers and explicitly approved modules.
  • Audit projects and diagnostic tools for direct or transitive NuGet dependencies on unpatched versions of Microsoft.DiaSymReader.Native.
  • Isolate CI/CD build and test execution for untrusted external pull requests to prevent malicious PDB artifacts from compromising build agents.

Remediation Steps:

  1. For .NET 8.0 on Windows, install .NET 8.0.34 or later from https://github.com/dotnet/runtime/releases/tag/v8.0.34.
  2. For .NET 9.0 on Windows, install .NET 9.0.23 or later from https://github.com/dotnet/runtime/releases/tag/v9.0.23.
  3. For .NET 10.0 on Windows, install .NET 10.0.15 or later from https://github.com/dotnet/runtime/releases/tag/v10.0.15.
  4. For .NET 11.0 on Windows, upgrade preview installations to the 11.0.0 GA release from https://github.com/dotnet/core/releases/tag/v11.0.0.
  5. For Visual Studio 2026, open the Visual Studio Installer and update v18.11 installations to 18.11.4+ or v18.12 installations to 18.12.0+.
  6. Verify that loaded instances of Microsoft.DiaSymReader.Native.*.dll reject Portable PDB files containing EmbeddedSource records with parent RID == 0.

References

Read the full report for CVE-2026-114158 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)