CVE-2026-114151

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

A remote code execution vulnerability (CVE-2026-114151) has been identified in Microsoft.DiaSymReader.Native, the native symbol reader that the .NET shared framework carries on Windows. Microsoft describes the issue as an out-of-bounds stack write that a crafted LF_DECIMAL payload in a PDB symbol file can trigger. HeroDevs investigation traced the .NET 6 exposure to the runtime's MicrosoftDiaSymReaderNativeVersion pin, which stayed below the fixed build through NES for .NET 6.0.48.

Per CWE-121: Stack-based Buffer Overflow, the weakness is a buffer overflow in which the buffer that is overwritten is allocated on the stack. Microsoft also assigns CWE-502: Deserialization of Untrusted Data.

Every .NET 6 release up to and including NES for .NET 6.0.48 carries an affected version of the component. It ships in-box in the Microsoft.NETCore.App shared framework rather than as an opt-in package, and it is Windows-only, so Linux and macOS layouts do not carry it at all. Exploitation requires user interaction: something must read a crafted PDB. Microsoft notes that the runtime's own stack-trace reader does not call the vulnerable API, though this excludes only that path, not .NET as a whole. Microsoft fixed the issue in its November 10, 2026 releases of .NET 8.0, 9.0, 10.0 and 11.0. Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

Details

Module Info

• Product: .NET
• Affected packages: Microsoft.DiaSymReader.Native (in-box in the Windows Microsoft.NETCore.App shared framework and its Microsoft.NETCore.App.Runtime.win-* runtime packs, not an opt-in package)
• Affected versions:
  • >=6.0.0 <=6.0.48
  • Microsoft.DiaSymReader.Native < 18.9.1-beta1.26515.1
• Package manager: NuGet, Windows Installer, Docker
• GitHub repository: https://github.com/dotnet/runtime
• Published packages: Download .NET, Microsoft.DiaSymReader.Native on NuGet
• Fixed in: NES for .NET 6.0.49 (SDK 6.0.440)

Vulnerability Info

This High-severity vulnerability is found in the native symbol reader carried by the Microsoft.NETCore.App shared framework on Windows, in versions of Microsoft.DiaSymReader.Native before 18.9.1-beta1.26515.1.

PDB files describe named constants with CodeView records, and a value too large for a plain integer is stored as a numeric leaf such as LF_DECIMAL, which encodes a decimal number. Callers read a constant's value through ISymUnmanagedConstant.GetValue, and that is the path Microsoft names. Microsoft states that processing a crafted LF_DECIMAL payload there can write outside the bounds of a stack buffer. The values driving the write come from the symbol file, so an attacker who supplies the PDB influences the overwrite, which underlies Microsoft's remote code execution classification.

CVE-2026-114151, CVE-2026-114152, CVE-2026-118745, CVE-2026-114158 and CVE-2026-114159 were reported separately and are addressed together by the single Microsoft.DiaSymReader.Native update to 18.9.1-beta1.26515.1 in NES for .NET 6.0.49.

The advisory's lower bound is open (< 18.9.1-beta1.26515.1), so the weakness is present in every .NET 6 release before NES for .NET 6.0.49 and likely earlier.

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to one of: .NET Runtime >=10.0.15, .NET Runtime >=11.0.0. .NET 8.0.34 and 9.0.23 are fixed but End-of-Life.
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.49 or later.

Credits

Microsoft's advisory acknowledges this report only under an opaque identifier (41ae55e9310ff27fa6f26af4727e5590) and does not publicly name an individual finder.