CVE-2026-114152: Stack-Based Buffer Overflow and Untrusted Pointer Dereference in Microsoft DiaSymReader.Native

CVE-2026-114152 is a memory corruption vulnerability residing in Microsoft.DiaSymReader.Native, the native Debug Interface Access (DIA) symbol reader component utilized by Microsoft Visual Studio 2026 and the .NET runtime (dotnet.exe) on Windows. This component is responsible for parsing Program Database (PDB) files, Common Object File Format (COFF) object files (.obj), and portable executable debug directories during compilation, symbol indexing, and diagnostic debugging sessions.

The core flaw involves two distinct but chained weakness classes within the DiaObjectFile::ApplyFixup routine: an untrusted pointer dereference (CWE-822) and a stack-based buffer overflow (CWE-121). When the symbol engine processes COFF section headers and their corresponding relocation tables (IMAGE_RELOCATION), it loads section data into a stack-allocated buffer and iterates through the relocation entries to apply address and displacement fixups.

Because the parser processes debug artifacts directly from project directories, NuGet packages, and remote symbol servers, it exposes a broad attack surface across developer workstations and Continuous Integration/Continuous Deployment (CI/CD) pipelines. An attacker who induces a developer or automated build agent to process a specially crafted .pdb or .obj file can corrupt the call stack of the host process (devenv.exe or dotnet.exe), resulting in arbitrary code execution under the privileges of the current user.

The root cause of CVE-2026-114152 lies in how DiaObjectFile::ApplyFixup calculates target memory addresses and resolves symbol table entries when applying COFF relocations to in-memory section data. In the COFF specification, each section header can specify a pointer to a table of IMAGE_RELOCATION structures. Each relocation entry contains a 32-bit VirtualAddress (representing the offset within the section where the fixup must be written), a 32-bit SymbolTableIndex, and a 16-bit Type indicator defining how the address calculation should be performed.

During symbol parsing, Microsoft.DiaSymReader.Native allocates a local buffer on the stack (or a stack-adjacent structure) to hold the raw data of the section undergoing relocation processing. As DiaObjectFile::ApplyFixup iterates over the array of relocation records supplied by the file, it computes the target write pointer by adding the attacker-controlled VirtualAddress offset from the relocation record directly to the base address of the local stack buffer.

The implementation fails to validate that the VirtualAddress offset, combined with the size of the relocation write (typically 4 or 8 bytes depending on the relocation type, such as IMAGE_REL_AMD64_ADDR64 or IMAGE_REL_AMD64_REL32), falls strictly within the allocated bounds of the stack buffer. If a relocation record specifies an oversized positive offset or a negative offset (when interpreted as a signed displacement), the resulting target pointer references memory outside the allocated buffer within the active stack frame.

Simultaneously, the function uses the SymbolTableIndex field from the IMAGE_RELOCATION record to look up the corresponding symbol value in the COFF symbol table without enforcing upper-bound checks against the total number of symbols present in the object file. This missing bounds check triggers an untrusted pointer dereference (CWE-822) when reading the symbol's virtual address or value, which is then written to the out-of-bounds stack address calculated in the previous step (CWE-121).

> [!NOTE] > Because COFF relocation types support both absolute address writes and relative displacement additions (where the parser reads the existing value at the target address, adds the resolved symbol offset, and writes the result back), an attacker gains both relative and direct arbitrary write primitives relative to the stack pointer (RSP/ESP).

While Microsoft.DiaSymReader.Native is distributed primarily as a compiled native binary (Microsoft.DiaSymReader.Native.amd64.dll / x86.dll), the structural logic of DiaObjectFile::ApplyFixup follows standard COFF relocation parsing patterns. In a standard COFF object file, a relocation entry is defined by the IMAGE_RELOCATION structure:

#pragma pack(push, 2)
typedef struct _IMAGE_RELOCATION {
    union {
        DWORD   VirtualAddress;
        DWORD   RelocCount;
    } DUMMYUNIONNAME;
    DWORD   SymbolTableIndex;
    WORD    Type;
} IMAGE_RELOCATION;
#pragma pack(pop)

In the vulnerable implementation of DiaObjectFile::ApplyFixup, the parser receives a pointer to a stack-allocated buffer representing the target section (pbSectionStackBuffer), the size of that buffer (cbSectionSize), and the array of relocation records. A reconstructed representation of the vulnerable logic illustrates the missing boundary validations:

// Reconstructed representation of vulnerable logic in DiaObjectFile::ApplyFixup
HRESULT DiaObjectFile::ApplyFixup(
    BYTE* pbSectionStackBuffer,
    DWORD cbSectionSize,
    const IMAGE_RELOCATION* pRelocations,
    DWORD cRelocations,
    const IMAGE_SYMBOL* pSymbolTable,
    DWORD cSymbols)
{
    for (DWORD i = 0; i < cRelocations; ++i) {
        const IMAGE_RELOCATION& reloc = pRelocations[i];
 
        // VULNERABILITY 1 (CWE-822): No bounds check on reloc.SymbolTableIndex against cSymbols.
        // An out-of-bounds index causes pSymbolTable[reloc.SymbolTableIndex] to dereference
        // arbitrary memory relative to the symbol table base.
        const IMAGE_SYMBOL& sym = pSymbolTable[reloc.SymbolTableIndex];
        ULONGLONG ullSymbolValue = ResolveSymbolAddress(&sym);
 
        // VULNERABILITY 2 (CWE-121): No bounds check on reloc.VirtualAddress against cbSectionSize.
        // pbTarget can point past the end of pbSectionStackBuffer into saved stack frames.
        BYTE* pbTarget = pbSectionStackBuffer + reloc.VirtualAddress;
 
        switch (reloc.Type) {
            case IMAGE_REL_AMD64_ADDR64:
                // Out-of-bounds 64-bit write on the stack
                *(ULONGLONG*)pbTarget += ullSymbolValue;
                break;
            case IMAGE_REL_AMD64_ADDR32:
                // Out-of-bounds 32-bit write on the stack
                *(DWORD*)pbTarget += (DWORD)ullSymbolValue;
                break;
            case IMAGE_REL_AMD64_REL32:
                // Out-of-bounds 32-bit relative displacement write
                *(DWORD*)pbTarget += (DWORD)(ullSymbolValue - ((ULONGLONG)pbTarget + 4));
                break;
        }
    }
    return S_OK;
}

To remediate both CWE-121 and CWE-822, the patched implementation in Visual Studio 2026 v18.12.0 and the November 2026 .NET servicing updates introduces strict validation before dereferencing symbol indices or writing to the section buffer. Specifically, the fix verifies that reloc.SymbolTableIndex is strictly less than the validated symbol count, and ensures that reloc.VirtualAddress plus the width of the specific relocation type does not overflow or exceed the allocated stack buffer size:

// Reconstructed representation of patched validation logic
for (DWORD i = 0; i < cRelocations; ++i) {
    const IMAGE_RELOCATION& reloc = pRelocations[i];
 
    // FIX (CWE-822): Validate SymbolTableIndex against total symbol count
    if (reloc.SymbolTableIndex >= cSymbols) {
        return E_INVALIDARG;
    }
 
    size_t cbWriteSize = GetRelocationWriteSize(reloc.Type);
 
    // FIX (CWE-121): Prevent integer overflow and verify target lies within buffer bounds
    if (reloc.VirtualAddress > cbSectionSize || 
        cbWriteSize > (cbSectionSize - reloc.VirtualAddress)) {
        return E_INVALIDARG;
    }
 
    // Safe to resolve symbol and apply fixup
    const IMAGE_SYMBOL& sym = pSymbolTable[reloc.SymbolTableIndex];
    // ...
}

Because the vulnerable write operation uses the += operator on the target address for most COFF relocation types, the bug provides a controlled addition primitive (*(ULONGLONG*)(StackBase + Offset) += ControlledValue). This primitive is particularly advantageous for attackers bypassing modern exploit mitigations.

If stack canaries (/GS security cookies) are present on the stack frame of DiaObjectFile::ApplyFixup or its callers, a sequential linear buffer overflow would overwrite the security cookie and trigger __report_gsfailure (STATUS_STACK_BUFFER_OVERRUN / 0xC0000409) upon function epilogue. However, because reloc.VirtualAddress is an arbitrary offset, an attacker can index directly over the /GS cookie, leaving it intact while modifying the saved return address (RIP) or caller stack frame variables directly.

Exploiting CVE-2026-114152 requires an attacker to deliver a crafted debug symbol file (.pdb) or COFF object file (.obj) to a target system running a vulnerable version of Visual Studio 2026 or the .NET SDK/Runtime on Windows. No prior authentication is required (PR:N), though user interaction (UI:R) or automated pipeline execution is necessary to trigger the parser.

A primary attack scenario involves supply chain or repository poisoning. An attacker creates or compromises a Git repository containing a .NET or C++ solution (.sln / .csproj / .vcxproj) alongside a precompiled binary and a malformed .pdb or .obj artifact. When a developer clones the repository and opens the solution in Visual Studio 2026, or executes dotnet build, dotnet test, or attaches a debugger, the IDE and runtime automatically invoke Microsoft.DiaSymReader.Native.dll to parse symbols for IntelliSense, call stack resolution, or code coverage analysis.

To achieve reliable code execution despite Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP), the attacker can leverage the indexed relative-add nature of DiaObjectFile::ApplyFixup. Rather than overwriting a saved return address on the stack with a hardcoded absolute pointer (which would fail without a separate information disclosure primitive to leak the base address of Microsoft.DiaSymReader.Native.dll), the attacker can use an IMAGE_REL_AMD64_ADDR64 or IMAGE_REL_AMD64_ADDR32 relocation record to add a constant displacement directly to an existing return address or function pointer already residing on the stack.

By shifting the least significant bytes of a saved return address pointing into Microsoft.DiaSymReader.Native.dll (or clr.dll / coreclr.dll), the attacker redirects execution to a Return-Oriented Programming (ROP) gadget within the same module without needing to know its randomized base address. Multiple relocation entries within the same COFF section can be processed sequentially in a single call to ApplyFixup, allowing the attacker to construct a full ROP chain on the stack above the modified return address before the function returns.

Microsoft assigned CVE-2026-114152 a CVSS v3.1 base score of 8.8 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The network attack vector (AV:N) reflects the standard distribution mechanism of software projects, NuGet dependencies, and symbol artifacts across network boundaries, while low attack complexity (AC:L) underscores that memory corruption is deterministic once the malformed relocation table is parsed.

Successful exploitation grants the attacker arbitrary code execution within the security context of devenv.exe, dotnet.exe, or vstest.console.exe. On a developer workstation, this context typically possesses high-value access, including local source code repositories, SSH keys, code-signing certificates, cloud provider CLI tokens (such as Azure CLI, AWS CLI, or GitHub tokens), and VPN access to internal corporate infrastructure.

In automated CI/CD build environments (such as self-hosted GitHub Actions runners, Azure DevOps agents, or Jenkins nodes running on Windows), the impact is particularly severe. Build pipelines routinely execute dotnet build or dotnet test on untrusted pull requests or third-party dependencies without human intervention. Compromising a build agent via a malformed symbol file allows an attacker to extract pipeline secrets, modify compiled release binaries prior to signing, or pivot laterally into production deployment environments.

At the time of disclosure, CVE-2026-114152 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no public proof-of-concept (PoC) exploits or active in-the-wild exploitation campaigns have been recorded.

Microsoft has addressed CVE-2026-114152 by releasing security updates for Visual Studio 2026 and all affected servicing branches of Microsoft .NET on Windows. Organizations should immediately upgrade their development environments, build servers, and runtime hosts to the patched releases:

• Microsoft Visual Studio 2026: Update to version 18.12.0 or later via the Visual Studio Installer.
• Microsoft .NET 8.0 (Windows): Update to version 8.0.34 or later.
• Microsoft .NET 9.0 (Windows): Update to version 9.0.23 or later.
• Microsoft .NET 10.0 (Windows): Update to version 10.0.15 or later.
• Microsoft .NET 11.0 (Windows): Update to version 11.0.0 (RTM) or later.

> [!NOTE] > Applications and libraries that statically bundle or redistribute standalone copies of Microsoft.DiaSymReader.Native via NuGet packages should ensure their package dependencies are updated and rebuilt against the patched native binaries.

For environments where immediate patching of developer workstations or build agents is delayed, several operational mitigations can reduce exposure:

1. Enforce Visual Studio Trust Settings: Configure Visual Studio to open solutions and folders from untrusted locations in Restricted Mode, preventing automatic background symbol indexing and build task execution.
2. Restrict Symbol Loading: In Visual Studio (Tools > Options > Debugging > Symbols), disable automatic symbol loading for all modules unless explicitly specified, and remove untrusted or public network paths from symbol file .pdb locations.
3. Isolate CI/CD Build Runners: Do not trigger automated dotnet build or dotnet test workflows on unreviewed pull requests from external forks on persistent, privileged build agents. Use ephemeral, network-isolated containers or virtual machines for untrusted builds.

Security operations teams can monitor for exploitation attempts by tracking Windows Error Reporting (WER) crash dumps and Event ID 1000 (Application Error) logs where the faulting module is Microsoft.DiaSymReader.Native.dll (or architecture-specific variants like Microsoft.DiaSymReader.Native.amd64.dll) with exception codes 0xC0000005 (STATUS_ACCESS_VIOLATION) or 0xC0000409 (STATUS_STACK_BUFFER_OVERRUN). Endpoint Detection and Response (EDR) rules should also alert on anomalous child processes (such as cmd.exe, powershell.exe, rundll32.exe, or regsvr32.exe) spawned directly by devenv.exe or vstest.console.exe during debugging or symbol loading operations.