Microsoft.DiaSymReader.Native PDB Processing Remote Code Execution

Successful exploitation can permit an unauthenticated attacker to execute arbitrary code in the security context of the vulnerable application. The listed CVSS v3.1 score is 8.8 (High), with high confidentiality, integrity, and availability impact. On developer systems, compromise could expose source code, credentials, and build assets; on servers, execution occurs under the affected .NET application's service account and could enable access to application data or further host compromise depending on assigned privileges.

Until updates are deployed, prevent affected applications, build systems, debugging tools, and symbol-processing workflows from processing PDB files from untrusted or unverified sources. Restrict access to systems and workflows that consume symbol files, apply network segmentation and least privilege, and monitor for anomalous PDB ingestion and child-process activity from .NET development or application processes.

Update Microsoft.DiaSymReader.Native to version 18.9.0-beta1.26405.2 or later, including any direct package references. Install the latest supported .NET runtime, SDK, or Visual Studio updates. For supported .NET Framework installations, apply the applicable September 2026 Windows/.NET Framework security update. Restart affected applications after updating packages, runtimes, SDKs, Visual Studio, or Windows components.