CVE-2026-114151: Remote Code Execution via Stack-Based Buffer Overflow in Microsoft Visual Studio and .NET Symbol Reader

Vulnerability ID: CVE-2026-114151
CVSS Score: 8.8
Published: 2026-11-11

CVE-2026-114151 is a high-severity remote code execution vulnerability affecting Microsoft Visual Studio 2026 and multiple supported versions of the Microsoft .NET runtime on Windows. The flaw resides in the native Debug Information Access (DIA) symbol reader component, Microsoft.DiaSymReader.Native. When parsing Program Database (.pdb) files, the component fails to validate the length of serialized numeric records (specifically LF_DECIMAL structures) before unpacking them into a fixed-size stack buffer. An attacker who convinces a user or automated diagnostic process to load a crafted .pdb file can trigger a stack-based buffer overflow, resulting in arbitrary code execution within the context of the host process.

TL;DR

A stack-based buffer overflow in Microsoft.DiaSymReader.Native allows remote code execution when Visual Studio 2026 or the .NET runtime parses a crafted Program Database (.pdb) file containing malformed LF_DECIMAL symbol records.

Technical Details

• Vulnerability Type: Stack-based Buffer Overflow / Untrusted Deserialization
• CWE ID: CWE-121 / CWE-502
• CVSS v3.1 Score: 8.8 High (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
• Vulnerable Component: Microsoft.DiaSymReader.Native (ISymUnmanagedConstant::GetValue)
• Attack Vector: Network / Malicious Program Database (.pdb) Symbol File
• Security Impact: Remote Code Execution (RCE) in Host Process Context
• Exploit Status: Unproven (No public PoC or active exploitation)
• CISA KEV Status: Not Listed

Affected Systems

• Microsoft Visual Studio 2026 (Windows)
• Microsoft .NET 8.0 (Windows)
• Microsoft .NET 9.0 (Windows)
• Microsoft .NET 10.0 (Windows)
• Microsoft .NET 11.0 (Windows)
• Microsoft.DiaSymReader.Native
• Visual Studio 2026: < 18.12.0 (Fixed in: 18.12.0)
• .NET 8.0: >= 8.0.0, < 8.0.34 (Fixed in: 8.0.34)
• .NET 9.0: >= 9.0.0, < 9.0.23 (Fixed in: 9.0.23)
• .NET 10.0: >= 10.0.0, < 10.0.15 (Fixed in: 10.0.15)
• .NET 11.0: >= 11.0.0-preview.1, < 11.0.0 (Fixed in: 11.0.0)
• Microsoft.DiaSymReader.Native: < 18.9.1-beta1.26515.1 (Fixed in: 18.9.1-beta1.26515.1)

Mitigation Strategies

• Upgrade Microsoft Visual Studio 2026 and all deployed .NET runtimes/SDKs on Windows to the November 2026 security servicing releases.
• Update explicit NuGet package references to Microsoft.DiaSymReader.Native to version 18.9.1-beta1.26515.1 or later.
• Restrict Visual Studio symbol resolution settings to trusted HTTPS symbol servers and disable automatic symbol loading for untrusted modules.
• Migrate build pipelines from legacy Windows PDB formats to Portable PDB formats where supported to leverage managed, bounds-checked symbol readers.

Remediation Steps:

1. Open the Visual Studio Installer and update Microsoft Visual Studio 2026 to version 18.12.0 or later.
2. Update .NET 8.0 SDK/Runtime installations on Windows to version 8.0.34.
3. Update .NET 9.0 SDK/Runtime installations on Windows to version 9.0.23.
4. Update .NET 10.0 SDK/Runtime installations on Windows to version 10.0.15.
5. Update .NET 11.0 preview installations on Windows to the official 11.0.0 RTM release.
6. Audit project files (*.csproj, Directory.Packages.props) for Microsoft.DiaSymReader.Native and update the version attribute to 18.9.1-beta1.26515.1 or higher.

References

• Microsoft Security Response Center (MSRC) Advisory: CVE-2026-114151
• Official CVE Record (CVE.org): CVE-2026-114151
• National Vulnerability Database (NVD) Entry: CVE-2026-114151
• MITRE ATT&CK Search Mapping: CVE-2026-114151
• .NET 10.0 Servicing Release v10.0.15
• .NET 11.0 Release v11.0.0
• .NET 8.0 Servicing Release v8.0.34
• .NET 9.0 Servicing Release v9.0.23

Read the full report for CVE-2026-114151 on our website for more details including interactive diagrams and full exploit analysis.