NUGET · SEPTEMBER 2026 · EARLY WARNING

Microsoft.DiaSymReader.Native Vulnerability: Early Warning and Mitigation

Q: Am I affected?

You may be affected if your Microsoft.NET project uses Microsoft.DiaSymReader.Native version greater than or equal to 17.10.0-beta1.24272.1 and less than 18.9.0-beta1.26405.2.

Q: What should I do right now?

Upgrade to the patched version 18.9.0-beta1.26405.2 of Microsoft.DiaSymReader.Native and review your project dependencies.

Q: Is there an official fix available?

Yes, the official fix is version 18.9.0-beta1.26405.2 of Microsoft.DiaSymReader.Native.

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.

Severity: HIGH
CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected component: Microsoft.DiaSymReader.Native (nuget)
Affected versions: >= 17.10.0-beta1.24272.1, < 18.9.0-beta1.26405.2 or >= 17.10.0-beta1.24272.1, < 18.9.0-beta1.26405.2 or >= 17.10.0-beta1.24272.1, < 18.9.0-beta1.26405.2
Patched version: 18.9.0-beta1.26405.2

CVE-2026-71328GHSA-63GH-G2X5-X69V

An early warning has been issued for a critical vulnerability in Microsoft.DiaSymReader.Native that could lead to remote code execution in.NET projects.

What happened

An early warning has been issued regarding a critical vulnerability in the Microsoft.DiaSymReader.Native package. This vulnerability, tracked as CVE-2026-71328 and GHSA-63GH-G2X5-X69V, allows for an out of bounds write when processing MSFZ PDB files, potentially leading to remote code execution. The vulnerability affects Microsoft.NET projects using specific versions of the Microsoft.DiaSymReader.Native package.

The vulnerability has a CVSS score of 8.8, indicating a high severity. It has not been reported as exploited in the wild. The issue was first flagged on September 9, 2026. The affected versions of Microsoft.DiaSymReader.Native are those greater than or equal to 17.10.0-beta1.24272.1 and less than 18.9.0-beta1.26405.2.

What to do about it

Upgrade to the patched version 18.9.0-beta1.26405.2 of Microsoft.DiaSymReader.Native.
Review your project dependencies to identify any use of the affected versions of Microsoft.DiaSymReader.Native.
Monitor the provided sources for updates and further information on the vulnerability.

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If Microsoft.DiaSymReader.Native is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

You may be affected if your Microsoft.NET project uses Microsoft.DiaSymReader.Native version greater than or equal to 17.10.0-beta1.24272.1 and less than 18.9.0-beta1.26405.2.

What should I do right now?

Upgrade to the patched version 18.9.0-beta1.26405.2 of Microsoft.DiaSymReader.Native and review your project dependencies.

Is there an official fix available?

Yes, the official fix is version 18.9.0-beta1.26405.2 of Microsoft.DiaSymReader.Native.

Sources

Join the 0Day waitlist →

← Back to all threats