Microsoft.DiaSymReader.Native MSFZ PDB Heap-Based Buffer Overflow RCE

CVE-2026-71328 is a heap-based buffer overflow in Microsoft.DiaSymReader.Native, affecting .NET and Visual Studio projects that use vulnerable package releases. While processing an MSFZ PDB file, the component can perform an out-of-bounds write. The underlying condition arises when stream-parsing logic allocates a heap buffer based on an attacker-controlled declared size and subsequently copies stream payload data without ensuring cumulative copied bytes remain within that allocation. A crafted file can declare a small size while containing a larger payload, corrupting adjacent heap memory.