CVE-2026-114159: Heap-Based Buffer Overflow in Microsoft Visual Studio and .NET Native Symbol Reader

Vulnerability ID: CVE-2026-114159
CVSS Score: 8.8
Published: 2026-11-11

CVE-2026-114159 is a heap-based buffer overflow vulnerability (CWE-122) in Microsoft.DiaSymReader.Native affecting Microsoft Visual Studio and the .NET Runtime on Windows. An integer truncation error during the parsing of oversized document names in Portable PDB symbol files causes an undersized heap allocation, leading to an out-of-bounds memory write and remote code execution.

TL;DR

A numeric truncation error in Microsoft.DiaSymReader.Native when parsing Portable PDB Document tables leads to an undersized heap buffer allocation and subsequent heap-based buffer overflow. Unauthenticated attackers can achieve arbitrary code execution by convincing a user or service to load a crafted PDB file or .NET assembly.

Technical Details

• Vulnerability Type: Heap-based Buffer Overflow (CWE-122)
• Affected Component: Microsoft.DiaSymReader.Native
• Attack Vector: Network / Crafted Portable PDB File (AV:N/UI:R)
• CVSS v3.1 Score: 8.8 High
• Security Impact: Arbitrary Code Execution (RCE)
• Exploit Maturity: Unproven (No public PoCs observed)
• CISA KEV Status: Not Listed

Affected Systems

• Microsoft Visual Studio 2026 (Windows)
• .NET 8.0 Runtime and SDK (Windows)
• .NET 9.0 Runtime and SDK (Windows)
• .NET 10.0 Runtime and SDK (Windows)
• .NET 11.0 Runtime and SDK (Windows)
• Visual Studio 2026: >= 18.11.0, < 18.11.4 (Fixed in: 18.11.4)
• Visual Studio 2026: >= 18.12.0, < 18.12.0 (Serviced) (Fixed in: 18.12.0 (Serviced Release))
• .NET 8.0 (Windows): >= 8.0.0, < 8.0.34 (Fixed in: 8.0.34)
• .NET 9.0 (Windows): >= 9.0.0, < 9.0.23 (Fixed in: 9.0.23)
• .NET 10.0 (Windows): >= 10.0.0, < 10.0.15 (Fixed in: 10.0.15)
• .NET 11.0 (Windows): >= 11.0.0-preview.1, < 11.0.0 (Fixed in: 11.0.0 (GA))

Mitigation Strategies

• Update Microsoft Visual Studio 2026 and all installed .NET Runtimes/SDKs on Windows to the November 2026 servicing releases.
• Disable automatic symbol downloading from untrusted or public symbol servers in Visual Studio debugging settings.
• Restrict opening or debugging untrusted third-party projects, binaries, and crash dumps to isolated sandbox environments.
• Enforce Windows Exploit Guard policies including Control Flow Guard (CFG) and Heap Termination on Corruption for devenv.exe and dotnet.exe.

Remediation Steps:

1. Update Microsoft Visual Studio 2026 18.11 to version 18.11.4 or later via the Visual Studio Installer.
2. Update Microsoft Visual Studio 2026 18.12 to the November 2026 serviced release of 18.12.0.
3. Update .NET 8.0 on Windows to version 8.0.34.
4. Update .NET 9.0 on Windows to version 9.0.23.
5. Update .NET 10.0 on Windows to version 10.0.15.
6. Update .NET 11.0 on Windows from preview releases to the 11.0.0 General Availability (GA) release.
7. Rebuild and redeploy any self-contained Windows .NET applications that bundle Microsoft.DiaSymReader.Native.*.dll.

References

• Microsoft Security Response Center (MSRC) Advisory: CVE-2026-114159
• CVE.org Official Record: CVE-2026-114159
• .NET 11.0 GA Release Details
• .NET 10.0.15 Servicing Release
• .NET 9.0.23 Servicing Release
• .NET 8.0.34 Servicing Release

Read the full report for CVE-2026-114159 on our website for more details including interactive diagrams and full exploit analysis.