Loading story…
Microsoft disclosed CVE-2026-71328, a high-severity remote code execution vulnerability in Microsoft.DiaSymReader.Native, a component used by .NET projects and Visual Studio to process debugging symbols. The flaw is a CWE-122 heap-based buffer overflow: a crafted MSFZ PDB file can trigger an out-of-bounds write during parsing, potentially allowing code execution. It carries a CVSS v3.1 score of 8.8 and affects specified package releases used across .NET 8, .NET 9, .NET 10, and .NET 11 RC1.
Microsoft resolved the issue in Microsoft.DiaSymReader.Native version 18.9.0-beta1.26405.2 and advises organizations to install the relevant .NET or Visual Studio updates, update any direct package references, and restart affected applications. The cumulative .NET 10.0.12 servicing update includes security fixes and supersedes .NET 10.0.11; it is available through Microsoft Update, WSUS, and the Microsoft Update Catalog.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft released the cumulative .NET 10.0.12 servicing update with security fixes. The update was made available through Microsoft Update, WSUS, and the Microsoft Update Catalog for supported systems.
Microsoft published an advisory for CVE-2026-71328, a high-severity CVSS 8.8 remote-code-execution flaw in Microsoft.DiaSymReader.Native caused by an out-of-bounds write while processing MSFZ PDB files. Microsoft fixed affected package versions in Microsoft.DiaSymReader.Native 18.9.0-beta1.26405.2 and advised updating .NET, Visual Studio, or direct package references.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
4 references tracked. Mallory keeps watching after this page renders.
support.microsoft.com
Open sourcegithub.com
Open sourcenuget.org
Open sourcesecurity.alpinelinux.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released security updates addressing **79 vulnerabilities** across its product portfolio, including **19 remote code execution** flaws and several issues already under active exploitation. The most severe bug, **`CVE-2024-43491`**, is a **Windows Update** use-after-free vulnerability with a **CVSS 9.8** rating that can allow **unauthenticated remote code execution**. Critical vulnerabilities were also reported in **Microsoft SharePoint Server**, **Azure Web Apps**, **Azure Stack Hub**, and **Windows Network Address Translation**, expanding the risk beyond endpoint systems to server and cloud-connected environments. Microsoft and third-party reporting said attackers were already exploiting **`CVE-2024-38014`** in **Windows Installer**, **`CVE-2024-38217`** in **Mark of the Web**, **`CVE-2024-38226`** in **Microsoft Publisher**, and **`CVE-2024-43491`** in **Windows Update**. The updates were published through Microsoft’s Security Update Guide and release notes, including related Mariner release information, and organizations were urged to prioritize deployment because the exploited flaws span privilege escalation and remote code execution paths across multiple supported Windows versions and Microsoft products.
Jul 24, 2026
Microsoft published multiple security advisories for **Windows**, **Azure**, and **developer tooling**, including several high-impact issues spanning **remote code execution (RCE)**, **elevation of privilege (EoP)**, **spoofing**, **information disclosure**, **denial of service**, and **security feature bypass**. Notable items include **Azure SDK for Python RCE** `CVE-2026-21531` (CVSS 9.8; **deserialization of untrusted data**), **Windows Shell security feature bypass** `CVE-2026-21510` (CVSS 8.8; exploitability listed as **E:F**), **GitHub Copilot/Visual Studio/VS Code** issues enabling **RCE/EoP/feature bypass** (`CVE-2026-21256`, `CVE-2026-21523`, `CVE-2026-21257`, `CVE-2026-21518`), and **Azure Local RCE** `CVE-2026-21228` (CVSS 8.1; **improper certificate validation**). Additional Windows platform flaws include **Desktop Window Manager EoP** `CVE-2026-21519` (type confusion), **HTTP.sys EoP** `CVE-2026-21232` (untrusted pointer dereference), **WinSock Ancillary Function Driver EoP** `CVE-2026-21238` (improper access control), **Windows Storage EoP** `CVE-2026-21508`, **WSL EoP** `CVE-2026-21237`, **Microsoft Word security feature bypass** `CVE-2026-21514`, **Outlook spoofing** `CVE-2026-21511`, **Windows LDAP DoS** `CVE-2026-21243`, plus **ACI Confidential Containers information disclosure** `CVE-2026-23655` and **Azure IoT Explorer information disclosure** `CVE-2026-21528`. Separately, a detailed third-party writeup described a **Windows Error Reporting Service** local privilege escalation, `CVE-2026-20817`, patched in January 2026, where the **WER service** (`wersvc.dll`) running as `NT AUTHORITY\SYSTEM` allegedly fails to validate requester permissions over **ALPC**, enabling a standard user to trigger process creation with a SYSTEM-derived token (retaining powerful rights such as *SeDebugPrivilege*, *SeImpersonatePrivilege*, and *SeBackupPrivilege*). Another third-party report highlighted a long-standing **libpng** heap buffer issue, `CVE-2026-25646` (CVSS 8.3), in `png_set_quantize()` that can be triggered by a crafted PNG (palette present, histogram absent) leading to an infinite loop/out-of-bounds read with potential for DoS and, with heap grooming, possible code execution; an additional MSRC entry referenced **libjpeg-turbo** `CVE-2023-2804` (heap-based overflow) as an Important RCE-class issue. Collectively, the disclosures reinforce the need to prioritize patching for internet-reachable components and developer tooling, and to treat local EoP bugs as high-risk in post-compromise and lateral movement scenarios.
Jun 29, 2026
Microsoft released an out-of-band update for **`Microsoft.AspNetCore.DataProtection` 10.0.7** to fix **`CVE-2026-40372`**, a critical ASP.NET Core elevation-of-privilege flaw caused by improper verification of cryptographic signatures (**`CWE-347`**). The regression affects package versions **10.0.0 through 10.0.6** and was uncovered while Microsoft investigated customer-reported decryption failures after the .NET 10.0.6 Patch Tuesday release. Microsoft said the bug in the managed authenticated encryptor could let unauthenticated attackers bypass HMAC validation, forge authentication cookies and other protected payloads, decrypt some protected data, and potentially authenticate as privileged users. The vulnerability primarily affects applications running the vulnerable NuGet package at runtime on **Linux, macOS, and other non-Windows systems**, with some **`net462`** and **`netstandard2.0`** consumers also exposed; Microsoft said Windows deployments and the **8.0.x** and **9.0.x** branches are not affected under the described conditions. Because ASP.NET Core Data Protection is widely used for cookies, tokens, anti-forgery protections, TempData, and similar application state, successful exploitation can enable file disclosure and data modification without impacting availability. Microsoft urged organizations to upgrade to **`10.0.7`**, rebuild and redeploy affected applications, rotate the **DataProtection key ring**, and audit long-lived tokens, API keys, password reset links, and logs because legitimately signed artifacts issued during exploitation may remain valid after patching.
Jun 29, 2026