CVE-2026-118745: Remote Code Execution via Heap-Based Buffer Overflow in Microsoft Visual Studio and .NET DiaSymReader

Vulnerability ID: CVE-2026-118745
CVSS Score: 8.8
Published: 2026-11-11

CVE-2026-118745 is a high-severity remote code execution vulnerability affecting Microsoft Visual Studio 2026 and multiple supported versions of the .NET runtime (8.0, 9.0, 10.0, and 11.0) on Windows systems. The flaw is a heap-based buffer overflow (CWE-122) located within the native symbol reading library, Microsoft.DiaSymReader.Native, specifically in the routines responsible for extracting and parsing Program Database (.pdb) line number metadata. An attacker can exploit this vulnerability by supplying a crafted .pdb file alongside a repository, project, or compiled binary. When a developer or automated diagnostic process parses the malformed debug symbols, an out-of-bounds heap write occurs, permitting arbitrary code execution within the security context of the active user process.

TL;DR

A heap-based buffer overflow in Microsoft.DiaSymReader.Native allows remote code execution when Microsoft Visual Studio or .NET processes parse maliciously crafted Program Database (.pdb) debug symbol files.

Technical Details

  • Vulnerability Class: CWE-122: Heap-based Buffer Overflow
  • Affected Component: Microsoft.DiaSymReader.Native (PDB Symbol Reader)
  • CVSS v3.1 Score: 8.8 High (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
  • Attack Vector: Network / Crafted Program Database (.pdb) File
  • Security Impact: Remote Code Execution (RCE) in User Context
  • Exploit Status: Unproven (No Public PoC)
  • CISA KEV Status: Not Listed

Affected Systems

  • Microsoft Visual Studio 2026 version 18.11 on Windows
  • Microsoft Visual Studio 2026 version 18.12 on Windows
  • Microsoft .NET 8.0 on Windows
  • Microsoft .NET 9.0 on Windows
  • Microsoft .NET 10.0 on Windows
  • Microsoft .NET 11.0 on Windows
  • Microsoft Visual Studio 2026 version 18.11: >= 18.11.0, < 18.11.4 (Fixed in: 18.11.4)
  • Microsoft Visual Studio 2026 version 18.12: < 18.12.0 (Fixed in: 18.12.0)
  • .NET 8.0: >= 8.0.0, < 8.0.34 (Fixed in: 8.0.34)
  • .NET 9.0: >= 9.0.0, < 9.0.23 (Fixed in: 9.0.23)
  • .NET 10.0: >= 10.0.0, < 10.0.15 (Fixed in: 10.0.15)
  • .NET 11.0: >= 11.0.0-preview.1, < 11.0.0 (Fixed in: 11.0.0)

Mitigation Strategies

  • Apply November 2026 security updates to all Microsoft Visual Studio 2026 and .NET installations on Windows.
  • Audit and rebuild standalone tools or self-contained applications that bundle Microsoft.DiaSymReader.Native directly via NuGet.
  • Enforce Visual Studio Trust Settings (Restricted Mode) when browsing or opening untrusted code repositories.
  • Restrict symbol server configurations (_NT_SYMBOL_PATH) to trusted, TLS-authenticated endpoints only.

Remediation Steps:

  1. Open the Visual Studio Installer on all developer workstations and update Visual Studio 2026 18.11 to 18.11.4+ or 18.12 to 18.12.0+.
  2. Download and install the patched .NET SDK and Hosting Bundles for .NET 8.0 (8.0.34), .NET 9.0 (9.0.23), .NET 10.0 (10.0.15), and .NET 11.0 (11.0.0) via Windows Update, WSUS, or direct Microsoft installers.
  3. Inspect CI/CD build agents and container images running on Windows to ensure base images and installed .NET SDKs are updated to the November 2026 servicing levels.
  4. Search project dependency files (packages.config, Directory.Packages.props, *.csproj) for explicit references to Microsoft.DiaSymReader.Native and upgrade to the patched package version.

References

Read the full report for CVE-2026-118745 on our website for more details including interactive diagrams and full exploit analysis.