CVE-2026-114158: Heap-Based Buffer Overflow in Microsoft.DiaSymReader.Native Portable PDB Parser

CVE-2026-114158 is a heap-based buffer overflow vulnerability (CWE-122) in Microsoft.DiaSymReader.Native, an unmanaged C++ dynamic-link library distributed with Microsoft Visual Studio and the .NET SDK and runtime on Windows. This native library provides low-level interfaces—specifically implementations of COM interfaces such as ISymUnmanagedReader—used by debuggers, compilers, and diagnostic tools to inspect debug symbols and map intermediate language (IL) instructions back to source code files and line numbers.

While modern .NET toolchains primarily produce Portable PDB files based on the ECMA-335 metadata format, many legacy and native Windows diagnostic subsystems within Visual Studio (devenv.exe), MSBuild, and runtime crash dump analyzers continue to consume symbols via the traditional unmanaged DIA (Debug Interface Access) and ISymUnmanagedReader APIs. Microsoft.DiaSymReader.Native acts as a compatibility bridge and native parser that reads both classic Windows PDBs and Portable PDB streams directly in unmanaged memory.

Because symbol loading occurs automatically during routine development workflows—such as opening a project solution, stepping into external NuGet package assemblies, inspecting stack traces, or analyzing crash dumps—the Portable PDB parser represents a high-exposure attack surface. When a developer or automated build agent processes an untrusted binary accompanied by a weaponized .pdb file (or an assembly with embedded Portable PDB metadata), the vulnerable native parser executes without sandboxing in the security context of the host process.

An attacker who crafts a Portable PDB containing malformed EmbeddedSource records in the CustomDebugInformation metadata table can trigger an out-of-bounds write on the process heap. Successful exploitation corrupts adjacent heap metadata or C++ object structures, allowing arbitrary code execution with the privileges of the logged-in developer or continuous integration service account.

The root cause of CVE-2026-114158 lies in improper bounds validation of metadata table indices within the Portable PDB parsing subsystem of Microsoft.DiaSymReader.Native. According to the Portable PDB specification (an extension of ECMA-335 Partition II), debug information is stored in structured metadata tables. Specifically, the Document table (0x30) lists source files referenced by the module, while the CustomDebugInformation table (0x37) stores extensible debug payloads—such as EmbeddedSource blobs—linked to parent metadata rows via a coded index (HasCustomDebugInformation).

In the ECMA-335 specification, metadata table references use 1-based Record Identifiers (RIDs), where 1 denotes the first row in a target table and 0 represents a null or invalid reference. When Microsoft.DiaSymReader.Native initializes its internal representation of source documents, it allocates a heap buffer sized according to the total number of rows declared in the Document table. As the parser iterates through CustomDebugInformation records of kind EmbeddedSource, it extracts the parent RID to associate the embedded source payload with its corresponding Document entry.

The vulnerability occurs because the parser fails to verify that the extracted parent RID falls within the valid range [1, DocumentTableRowCount] before translating the 1-based RID into a 0-based C++ array index. When the parser encounters a malformed EmbeddedSource record specifying a parent RID of 0, the index calculation (index = RID - 1) underflows to -1 (or 0xFFFFFFFF when treated as an unsigned 32-bit integer).

Subsequently, the parser uses this underflowed or out-of-bounds index as an offset into the heap-allocated document array to write pointers or metadata describing the embedded source stream. Because no bounds check guards this memory write operation, the parser overwrites memory outside the allocated heap buffer boundary. Depending on whether the offset is evaluated as signed (-1, writing immediately prior to the buffer start and corrupting the heap chunk header) or unsigned (0xFFFFFFFF, writing at a large positive offset from the buffer base), an attacker can corrupt adjacent heap structures and hijack control flow.

While Microsoft.DiaSymReader.Native is distributed primarily as compiled native binaries (Microsoft.DiaSymReader.Native.x86.dll, Microsoft.DiaSymReader.Native.amd64.dll, and Microsoft.DiaSymReader.Native.arm64.dll) within the .NET SDK and Visual Studio installations, the mechanics of the flaw and its corresponding remediation are clearly defined by the Portable PDB table indexing logic.

In the unpatched implementation, when reconstructing document records from the CustomDebugInformation table (0x37), the native parser decodes the Parent column (HasCustomDebugInformation coded token) to obtain the target table tag and the 1-based parentRid. Upon confirming that the Kind GUID matches EmbeddedSource, the parser directly indexes into the heap-allocated document array using parentRid - 1 without validating the lower or upper bounds.

// Conceptual representation of the vulnerable native parsing logic
// inside Microsoft.DiaSymReader.Native Portable PDB reader
HRESULT ParseEmbeddedSourceRecords(
    MetadataTables* pTables,
    DocumentData* pDocumentBuffer, // Allocated on heap with size: cDocuments * sizeof(DocumentData)
    ULONG cDocuments)
{
    ULONG cCustomDebugRows = pTables->GetRowCount(TABLE_CustomDebugInformation);
 
    for (ULONG i = 1; i <= cCustomDebugRows; i++)
    {
        GUID kindGuid;
        ULONG parentTable, parentRid;
        const BYTE* pBlobData = nullptr;
        ULONG cbBlobSize = 0;
 
        pTables->GetCustomDebugInfoRow(i, &parentTable, &parentRid, &kindGuid, &pBlobData, &cbBlobSize);
 
        if (parentTable == TABLE_Document && IsEqualGUID(kindGuid, GUID_EmbeddedSource))
        {
            // VULNERABILITY: No bounds check on parentRid before 1-based to 0-based conversion.
            // If parentRid == 0, docIndex underflows to 0xFFFFFFFF (or -1 as signed INT32).
            // If parentRid > cDocuments, docIndex exceeds the allocated buffer size.
            ULONG docIndex = parentRid - 1;
 
            // Out-of-bounds heap write (CWE-122)
            pDocumentBuffer[docIndex].pEmbeddedSourceBlob = pBlobData;
            pDocumentBuffer[docIndex].cbEmbeddedSourceSize = cbBlobSize;
        }
    }
    return S_OK;
}

In the patched versions released by Microsoft (.NET 8.0.34, 9.0.23, 10.0.15, 11.0.0, and Visual Studio 2026 18.11.4 / 18.12.0), the native symbol reader introduces strict boundary validation on the parentRid prior to computing the buffer index.

// Conceptual representation of the patched native parsing logic
        if (parentTable == TABLE_Document && IsEqualGUID(kindGuid, GUID_EmbeddedSource))
        {
            // FIX: Enforce 1-based RID bounds against the allocated Document table row count
            if (parentRid == 0 || parentRid > cDocuments)
            {
                return COR_E_BADIMAGEFORMAT; // Abort parsing with HRESULT failure
            }
 
            ULONG docIndex = parentRid - 1;
            pDocumentBuffer[docIndex].pEmbeddedSourceBlob = pBlobData;
            pDocumentBuffer[docIndex].cbEmbeddedSourceSize = cbBlobSize;
        }

> [!NOTE] > Fix Completeness Assessment: Enforcing the invariant parentRid > 0 && parentRid <= DocumentTableRowCount completely mitigates both the integer underflow condition (parentRid == 0) and forward out-of-bounds heap writes (parentRid > DocumentTableRowCount) within the EmbeddedSource parser. However, because ECMA-335 and Portable PDB files utilize 1-based RIDs across multiple cross-referenced metadata tables (such as MethodDebugInformation, LocalScope, LocalVariable, and StateMachineMethod), security researchers auditing symbol parsers should verify that identical bounds checks are consistently applied across all coded index decoders in Microsoft.DiaSymReader.Native.

Exploiting CVE-2026-114158 requires an attacker to induce a target user or automated build system to load a crafted Portable PDB file using an unpatched version of Visual Studio 2026 or the .NET SDK/runtime. Because no prior authentication is required and the payload can be delivered via remote repositories or package feeds, the CVSS v3.1 vector classifies the Attack Vector as Network (AV:N) with Required User Interaction (UI:R).

An attack typically follows a multi-stage workflow targeting software developers or CI/CD infrastructure:

1. Payload Construction: The attacker generates a valid .NET assembly (.dll or .exe) and an accompanying Portable PDB file (.pdb). Alternatively, the attacker embeds the Portable PDB directly into the PE image using the IMAGE_DEBUG_TYPE_EMBEDDED_PORTABLE_PDB debug directory entry, ensuring symbols are parsed even if standalone .pdb loading is disabled.
2. Metadata Tampering: Using a custom binary editor, the attacker modifies the #Pdb and #~ streams of the Portable PDB. Specifically, the attacker adds or modifies a row in the CustomDebugInformation (0x37) table with the EmbeddedSource GUID (0E8A571B-6926-466E-B4AD-8AB04611F5FE), setting its Parent coded index to reference the Document table with RID = 0 (or a value exceeding the Document row count).
3. Heap Grooming and Corruption: By controlling the number of Document rows (which dictates the allocation size of the target heap buffer) and embedding multiple crafted streams within the #Blob heap, the attacker influences the Windows Low Fragmentation Heap (LFH) or Segment Heap layout. When Microsoft.DiaSymReader.Native writes the blob pointer and size to pDocumentBuffer[-1], it overwrites adjacent heap chunk headers or vtable pointers of neighboring C++ COM objects (such as SymReader or IMetaDataImport instances).
4. Delivery and Trigger: The weaponized project, NuGet package, or crash dump is delivered via a Git pull request, an untrusted NuGet feed, or a developer forum. When the victim opens the solution in Visual Studio 2026, initiates a build/test run via dotnet test, or attaches a debugger that resolves symbols through Microsoft.DiaSymReader.Native, the corrupted vtable pointer is dereferenced, redirecting execution to attacker-controlled shellcode.

At the time of publication, Microsoft rates Exploit Code Maturity as Unproven (E:U), and exhaustive searches across public repositories (Exploit-DB, GitHub, PacketStorm) confirm that no public Proof-of-Concept (PoC) or weaponized exploit code has been released.

Microsoft and the NVD have assigned CVE-2026-114158 a CVSS v3.1 Base Score of 8.8 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The high severity rating reflects the fact that successful exploitation grants an attacker complete control over the vulnerable process without requiring special environmental configurations (AC:L) or authentication (PR:N).

When triggered on a developer workstation within Visual Studio 2026 (devenv.exe) or the .NET CLI (dotnet.exe), arbitrary code execution occurs with the full privileges of the interactive user. Developer workstations typically hold high-value assets, including SSH keys, cloud provider credentials (AWS, Azure, GCP tokens), source code signing certificates, and authenticated sessions to internal source control and production environments. Furthermore, developers frequently run Visual Studio with elevated local administrator privileges to support local IIS debugging or Windows service profiling, which elevates the impact to full system compromise.

In automated enterprise environments, CVE-2026-114158 poses a supply-chain risk to Continuous Integration and Continuous Deployment (CI/CD) pipelines. Build agents that compile pull requests, run unit tests with code coverage, or generate symbol packages often invoke Microsoft.DiaSymReader.Native automatically when processing dependencies or generating stack traces for failing tests. In this scenario, submitting a malicious pull request containing a modified binary test fixture or Portable PDB can compromise the build runner without manual human interaction.

Regarding threat intelligence telemetry, CVE-2026-114158 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and there is no evidence of active in-the-wild exploitation or ransomware integration.

To remediate CVE-2026-114158, organizations must apply the official security updates released by Microsoft across all developer workstations, build agents, and production Windows servers hosting affected .NET runtimes or SDKs.

Microsoft has addressed the vulnerability in the following versions:

• Microsoft .NET 8.0: Upgrade to runtime and SDK release 8.0.34 or later.
• Microsoft .NET 9.0: Upgrade to runtime and SDK release 9.0.23 or later.
• Microsoft .NET 10.0: Upgrade to runtime and SDK release 10.0.15 or later.
• Microsoft .NET 11.0: Upgrade to General Availability (GA) release 11.0.0 or later.
• Microsoft Visual Studio 2026 (v18.11): Update to version 18.11.4 or later via the Visual Studio Installer.
• Microsoft Visual Studio 2026 (v18.12): Update to version 18.12.0 or later via the Visual Studio Installer.

> [!NOTE] > Standalone Package Dependencies: Applications or diagnostic tools that explicitly reference the Microsoft.DiaSymReader.Native NuGet package as a direct or transitive dependency should ensure their bundled native binaries (Microsoft.DiaSymReader.Native.*.dll) are updated to the patched builds corresponding to the servicing releases above.

In environments where immediate patching of all developer tools or build servers is not feasible, security teams should implement the following defensive workarounds to reduce attack surface exposure:

1. Restrict Symbol Loading in Visual Studio: Configure Visual Studio debugging options (Tools -> Options -> Debugging -> Symbols) to load only specified modules or symbols from trusted internal symbol servers, and disable automatic symbol resolution from untrusted local directories or external URLs.
2. Quarantine Untrusted .pdb Artifacts: Treat standalone .pdb files and pre-compiled third-party assemblies from untrusted repositories with the same security posture as untrusted executables. Block unverified .pdb files in email gateways and require manual approval before executing CI/CD workflows on external pull requests.