CVE-2026-69522

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

A remote code execution vulnerability (CVE-2026-69522) has been identified in Microsoft.DiaSymReader.Native, the native symbol reader that the .NET shared framework carries on Windows. Microsoft describes the issue as an out of bounds write that can occur when processing PDB files. HeroDevs investigation traced the .NET 6 exposure to the runtime's MicrosoftDiaSymReaderNativeVersion pin, which has sat inside the advisory's range since Microsoft's final .NET 6.0 release.

Per CWE-122: Heap-based Buffer Overflow, the weakness is a buffer overflow in which the buffer that is overwritten is allocated on the heap.

Every .NET 6 release up to and including NES for .NET 6.0.45 carries an affected version of the component. It ships in-box in the Microsoft.NETCore.App shared framework rather than as an opt-in package, and it is Windows-only, so Linux and macOS layouts do not carry it at all. Exploitation requires user interaction: something must read a crafted PDB. Microsoft also serviced supported releases in its September 8, 2026 security updates for .NET 8.0, .NET 9.0, and .NET 10.0, and separately serviced the affected .NET Framework versions. Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

Details

Module Info

• Product: .NET
• Affected packages: Microsoft.DiaSymReader.Native (in-box in the Microsoft.NETCore.App shared framework at runtimes/win/native/, not an opt-in package)
• Affected versions:
  
  • >=6.0.0 <=6.0.45
  • Microsoft.DiaSymReader.Native >=17.10.0-beta1.24272.1, <=18.9.0-beta1.26405.1
• Package manager: NuGet, Windows Installer, Docker
• GitHub repository: https://github.com/dotnet/runtime
• Published packages: Download .NET, Microsoft.DiaSymReader.Native on NuGet
• Fixed in:
  
  • NES for .NET 6.0.46

Vulnerability Info

This High-severity vulnerability is found in the native symbol reader carried by the Microsoft.NETCore.App shared framework on Windows, in versions of Microsoft.DiaSymReader.Native before 18.9.0-beta1.26405.2.

Windows PDB files store line-number information in CodeView C13 line sections, which the reader walks to map instruction offsets back to source positions. While enumerating those sections, EnumC13Lines::getLinesColumns computed a copy length from values in the file and then issued a memcpy of that length into a fixed destination buffer, without checking the length against the destination's capacity. A crafted PDB declaring an oversized line or column count therefore writes past the end of the buffer. Because both the length and the copied bytes come from the file, an attacker who controls the PDB controls the overflow, which is the basis for Microsoft's remote code execution classification.

CVE-2026-69439, CVE-2026-69522 and CVE-2026-71328 were reported separately and are addressed together by the single Microsoft.DiaSymReader.Native package update in NES for .NET 6.0.46.

The advisory's lower bound, 17.10.0-beta1.24272.1, is the exact version Microsoft pinned in its own final .NET 6.0 release, so the weakness is present in every .NET 6 release from that point forward and likely earlier.

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to one of: .NET Runtime >=8.0.31, .NET Runtime >=9.0.20, .NET Runtime >=10.0.12.
• Where an application references Microsoft.DiaSymReader.Native directly, update that reference to 18.9.0-beta1.26405.2 or later.
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.46 or later.