Overview of CVE-2026-114152: Stack Buffer Overflow in the Visual Studio and .NET Native Symbol Reader

Introduction

A memory corruption bug in the native symbol reader that ships with Visual Studio and inside .NET on Windows means that a crafted set of debugging artifacts, opened by a user, can lead to code execution on the machine that processes them. Because the same component reaches systems through Visual Studio, installed .NET runtimes, every installed SDK feature band, and applications that carry their own runtime, closing CVE-2026-114152 takes more than one update on one machine.

Microsoft published the advisory on November 10, 2026 as part of its November Patch Tuesday release. The CVE data lists the vendor as unknown, but the vendor and assigning CNA is Microsoft Corporation. The CVSS 3.1 base score is 8.8 (High), while Microsoft's own product severity is Important. These are separate classifications, and we keep them separate below.

Technical information

Root cause

The vulnerable code lives in Microsoft.DiaSymReader.Native, the closed-source native PDB and symbol reader. The dotnet/runtime advisory traces the bug to a single function, DiaObjectFile::ApplyFixup, where attacker-controlled COFF relocation offsets can cause an out-of-bounds write on the stack.

The reader applies relocations (fixups) while loading document information from a PDB that points to a COFF object file. Before the fix, it used the relocation offset taken from that object file as a position inside a stack buffer. A crafted object file can therefore aim the write outside the buffer. All versions of the component earlier than 18.9.1-beta1.26515.1 are affected.

Microsoft assigns two weakness classifications:

• CWE-121, Stack-based Buffer Overflow: writing beyond a buffer allocated on the stack. The documented ApplyFixup write maps directly to this.
• CWE-822, Untrusted Pointer Dereference: obtaining a value from an untrusted source, converting it to a pointer, and dereferencing it. The relocation offset read from the file and used as a write position fits this description, but the advisory does not map the weakness to individual instructions.

Because the component is closed source and the fix ships only as updated binaries, there is no public diff and no vulnerable code to show here. The sources also do not describe a specific control flow hijack, mitigation bypass, or exploit payload, so we do not speculate about one.

CVSS breakdown

The base vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H:

• Attack vector: Network
• Attack complexity: Low
• Privileges required: None
• User interaction: Required
• Scope: Unchanged
• Confidentiality, Integrity, Availability: High, High, High

Microsoft also lists a temporal score of 7.7. That lower number reflects temporal factors such as exploit code maturity (rated Unproven) and an available official fix. It does not replace the 8.8 base score. The network attack vector does not correspond to any listening port or protocol in the advisory. The delivery model is a file that a user opens.

Attack flow

Based on Microsoft's advisory and attack scenario, the documented chain looks like this:

1. The attacker prepares a COFF object file containing crafted relocation offsets, along with a PDB that references that object.
2. The attacker delivers the crafted file to the target. Microsoft's scenario requires a user to open a specially crafted file supplied by the attacker.
3. The user opens it, and an application that uses Microsoft.DiaSymReader.Native loads document information from the PDB, which leads the reader to the attacker-influenced COFF object.
4. While applying fixups, DiaObjectFile::ApplyFixup uses the attacker-supplied relocation offset as a position in a stack buffer. An out-of-range offset writes outside that buffer.
5. Microsoft states this can allow code execution. The sources do not document the resulting privilege context or a complete exploit chain.

Exposure therefore depends on the affected reader processing the specific malicious inputs described above, which is a much narrower condition than having Visual Studio installed.

Exploitation status

At original publication, MSRC recorded Publicly disclosed: No, Exploited: No, and Exploitation Less Likely. Exploit code maturity is Unproven, which Microsoft defines as: "No publicly available exploit code is available, or an exploit is theoretical."

The Zero Day Initiative November 2026 review likewise lists CVE-2026-114152 as Important with CVSS 8.8 and does not mark it as exploited. The actively attacked bug that month was CVE-2026-124194, an Outlook spoofing issue, so the month's exploitation headlines should not be attached to this one.

The retrieved CISA KEV catalog (version 2026.11.10, released 2026-11-10T19:03:29.8375Z, 1,779 entries) does not include this CVE. Its absence is a dated catalog observation and does not show that exploitation cannot occur. No threat actor, campaign, malware family or indicators of compromise are associated with it. Microsoft acknowledges C0rk1 (handle c0rk1_h) for the report. That is a researcher credit, not an attribution.

Patch information

Microsoft fixed CVE-2026-114152 in its November 10, 2026 Patch Tuesday release. MSRC lists the Remediation Level as Official Fix, and the fix ships as updated binaries. The fixed component is Microsoft.DiaSymReader.Native 18.9.1-beta1.26515.1.

Microsoft has not described the code change. Given the root cause, the fix most likely checks each relocation offset against the size of the destination buffer before writing and rejects offsets that fall outside it. That is our inference, and Microsoft has not confirmed it.

How the fix is delivered

DiaSymReader.Native is not offered as a separate NuGet update. The advisory states it is delivered "through .NET Core rather than as a standalone customer NuGet update." You get the fix by updating the runtime, the SDK, or Visual Studio (Windows):

• .NET 8.0: runtime 8.0.34; SDK 8.0.134 and 8.0.428
• .NET 9.0: runtime 9.0.23; SDK 9.0.124 and 9.0.321
• .NET 10.0: runtime 10.0.15; SDK 10.0.115 and 10.0.404
• .NET 11.0: runtime 11.0.0 (GA); SDK 11.0.100
• Visual Studio 2026: build 18.12.0

Additional details:

• Self-contained runtime packs: Microsoft.NETCore.App.Runtime.win-x86, Microsoft.NETCore.App.Runtime.win-x64 and Microsoft.NETCore.App.Runtime.win-arm64 are fixed at the same runtime versions listed above.
• KB articles: MSRC links KB5135243 (.NET 8), KB5135242 (.NET 9) and KB5135241 (.NET 10). The .NET 11 entry links to the 11.0.0 release notes instead.
• Servicing post: Microsoft's November 2026 .NET servicing post lists this CVE with the other fixes in the release and links the release notes for 8.0.34, 9.0.23, 10.0.15 and 11.0.0.

Getting the fix applied

Because the fix lives in a native DLL bundled with the runtime, installing an update does not always replace vulnerable code that is already deployed. Each of these is a separate completion boundary:

• Shared installs: update the machine-wide .NET runtime.
• SDKs: update every installed SDK feature band to its listed version or later. Each band carries its own bundled runtime, so updating only the newest one is not enough.
• SDKs installed by Visual Studio: update Visual Studio as well.
• Self-contained apps, or apps that ship their own runtime: update the runtime used to build the application, rebuild, and redeploy. A machine-wide runtime update does not replace a runtime embedded in an application.
• Running processes: restart any process that already loaded the old native reader, since the vulnerable DLL stays in memory until then.

The embedded runtime case is the one most likely to be missed, because a host can show a correctly patched runtime while an application on it still carries its own vulnerable copy. Microsoft documents no CVE-specific workaround.

Affected systems and versions

The advisory lists Windows on x86, x64 and Arm64. Affected configurations are applications that use Microsoft.DiaSymReader.Native to load document information from a PDB that references an attacker-influenced COFF object.

• Microsoft.DiaSymReader.Native: all versions earlier than 18.9.1-beta1.26515.1
• .NET 8.0 runtime: 8.0.0 and later, earlier than 8.0.34
• .NET 9.0 runtime: 9.0.0 and later, earlier than 9.0.23
• .NET 10.0 runtime: 10.0.0 and later, earlier than 10.0.15
• .NET 11.0 runtime: 11.0.0-preview.1 and later, earlier than 11.0.0
• SDK feature bands: 8.0.1xx (fixed in 8.0.134), 8.0.4xx (fixed in 8.0.428), 9.0.1xx (fixed in 9.0.124), 9.0.3xx (fixed in 9.0.321), 10.0.1xx (fixed in 10.0.115), 10.0.4xx (fixed in 10.0.404), 11.0.1xx (fixed in 11.0.100)
• Windows runtime packs: win x86, win x64 and win arm64 at the affected runtime versions above
• Applications that embed an affected runtime: including self-contained applications, until rebuilt and redeployed
• Visual Studio 2026 version 18.12: MSRC's security update table lists build 18.12.0 as the fixed build. The CVE record also labels 18.12.0 as affected, and NVD renders the range as "18.12.0 < 18.12.0", which appears to be a data error. We rely on MSRC's update table here rather than reconstructing a range.

Vendor security history

Visual Studio has substantial reach in developer workflows. The 2026 Stack Overflow Developer Survey reports Visual Studio usage of 27.6% (3,643 of 13,193 respondents to the relevant question). Visual Studio Code is reported separately at 70.9%, and that figure should not be attributed to the affected product. Both are survey usage numbers and do not measure market share.

Microsoft's Security Development Lifecycle includes threat modeling, security testing, software supply chain security, engineering environment security, and monitoring and response. Those are process commitments. They do not show that a given release is free of defects.

The Cyber Safety Review Board's review of the 2023 Exchange Online intrusion concluded that the intrusion was preventable and that Microsoft's security culture was inadequate, citing failure to detect the compromise independently and delayed correction of inaccurate public statements. That incident, and its attribution to Storm-0558, is unrelated to this Visual Studio defect.

Microsoft's July 2026 Secure Future Initiative report claims 99.97% user and device coverage for phishing-resistant MFA, retirement of 1.4M unused Entra applications, 98.7% cross-boundary credential isolation, and removal of public access from 732,000 resources. These are vendor-reported program outcomes. For this CVE, the product-specific update instructions are what matter, and Microsoft recommends running the latest Visual Studio release on your chosen supported channel.

References

• NVD entry for CVE-2026-114152
• CVE Record for CVE-2026-114152
• Microsoft Security Update Guide: Visual Studio Remote Code Execution Vulnerability
• dotnet/runtime security advisory
• dotnet/runtime security advisory (GitHub API)
• GitHub Advisory Database entry
• dotnet/announcements issue 523
• .NET and .NET Framework November 2026 servicing updates
• Visual Studio 2026 release notes
• Visual Studio Product Lifecycle and Servicing
• What Is Visual Studio?
• Zero Day Initiative: The November 2026 Security Update Review
• CISA Known Exploited Vulnerabilities feed
• CWE 121: Stack-based Buffer Overflow
• CWE 822: Untrusted Pointer Dereference
• Microsoft Security Development Lifecycle Practices
• SFI Progress Report July 2026
• CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion
• Stack Overflow Developer Survey 2026: Technology data