Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
.NET
.NET NuGet
Not in CISA KEV
HIGH severity

Microsoft Security Advisory CVE-2026-69439 – .NET and Visual Studio Elevation of Privilege VulnerabilityGHSA-527h-q9f6-p7qx

HIGH

GHSA-527h-q9f6-p7qx is a high-severity (CVSS 8.8) CWE-122 vulnerability in Microsoft.DiaSymReader.Native. A fix is available for Microsoft.DiaSymReader.Native — see the affected versions and patch details below.

Also known asBIT-dotnet-2026-69439BIT-dotnet-sdk-2026-69439CVE-2026-69439
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Oct 23, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • A successful exploit gives an attacker total control of the affected component, not partial access.
  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for GHSA-527h-q9f6-p7qx.

EPSS Exploitation Probability

via FIRST.org ↗
0.8%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs57th percentile — riskier than 57% of all scored CVEsHighest risk
0.34%0.67%1.01%1.34%0.8%0.8%Oct 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

GHSA-527h-q9f6-p7qx by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.

Where this sits among everything scored

Of 394,803 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.

Real-World Exposure

1 pkg affected
.NETMicrosoft.DiaSymReader.Native

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects NuGet packages — download data is not available via public APIs for these ecosystems.

Description

Microsoft Security Advisory CVE-2026-69439 – .NET and Visual Studio Elevation of Privilege Vulnerability

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.DiaSymReader.Native. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

An out of bounds write can occur when parsing a Portable PDB file.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/438

CVSS Details

  • Version: 3.1
  • Severity: High
  • Score: 8.8
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  • Weakness: CWE-122 (Heap-based Buffer Overflow)

Affected Platforms

  • Platforms: Windows
  • Architectures: All

<a name="affected-packages"></a>Affected Packages

The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed below

<a name=".NET 11 RC1"></a>.NET 11 RC1

Package nameAffected versionPatched version
Microsoft.DiaSymReader.Native>= 17.10.0-beta1.24272.1, <= 18.9.0-beta1.26405.118.9.0-beta1.26405.2

<a name=".NET 10"></a>.NET 10

Package nameAffected versionPatched version
Microsoft.DiaSymReader.Native>= 17.12.0-beta1.24603.5, <= 18.9.0-beta1.26405.118.9.0-beta1.26405.2

<a name=".NET 9"></a>.NET 9

Package nameAffected versionPatched version
Microsoft.DiaSymReader.Native>= 17.12.0-beta1.24603.5, <= 18.9.0-beta1.26405.118.9.0-beta1.26405.2

<a name=".NET 8"></a>.NET 8

Package nameAffected versionPatched version
Microsoft.DiaSymReader.Native>= 17.12.0-beta1.24603.5, <= 18.9.0-beta1.26405.118.9.0-beta1.26405.2

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

If using a package listed in affected packages, a project is exposed to the vulnerability.

<a name="how-fix"></a>How do I fix the issue?

  1. To fix the issue please install the latest version of .NET or Visual Studio.
  2. If a developer's application references Microsoft.DiaSymReader.Native, update the package reference to version 18.9.0-beta1.26405.2 or later.

Once developers have installed the updated runtime, SDK, Visual Studio, or package, they should restart their apps in order for the update to take effect.

Other Information

Reporting Security Issues

If users have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.

Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Support

Users can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. Users can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2026-69439

Acknowledgements

41ae55e9310ff27fa6f26af4727e5590

Revisions

V1.0 (09/08/2026): Advisory published.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
.NETNuGetMicrosoft.DiaSymReader.Native≥ 17.10.0-beta1.24272.1&&< 18.9.0-beta1.26405.218.9.0-beta1.26405.2dotnet add package Microsoft.DiaSymReader.Native --version 18.9.0-beta1.26405.2

Affected Products

3 products · 12 configurations
Application
.netmicrosoft
≥ 10.0.0 && < 10.0.12
1 version
11.0.0
Application
visual studio 2022microsoft
≥ 17.14.0 && < 17.14.40
range
Application
visual studio 2026microsoft
≥ 18.9.0 && < 18.9.3
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for Microsoft.DiaSymReader.Native, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update Microsoft.DiaSymReader.Native to 18.9.0-beta1.26405.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-527h-q9f6-p7qx is resolved across your whole dependency graph.

  3. Workarounds

    Stop feeding it untrusted input: reject or quarantine files and payloads from unverified sources until you can upgrade, restrict accepted formats to the ones you actually need, and run the parsing or decoding step in a least-privileged sandbox or short-lived worker so a crash or corrupted read cannot reach the rest of the process.

Frequently Asked Questions

# Microsoft Security Advisory CVE-2026-69439 – .NET and Visual Studio Elevation of Privilege Vulnerability ## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.DiaSymReader.Native. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. An out of bounds write can occur when parsing a Portable PDB file. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/438 ## CVSS Details - **Version:** 3.1 - **S
O3 Security · Impact-Aware SCA

Is GHSA-527h-q9f6-p7qx in your dependencies?

Find it across NuGet, including transitive dependencies.

Scan my dependencies How O3 SCA works
Microsoft Security Advisory CVE-2026-69439 – .NET and…