Microsoft.DiaSymReader.Native Vulnerability: Critical CVE Alert
- Severity
- HIGH
- CVSS
- 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
- Affected component
- Microsoft.DiaSymReader.Native (nuget)
- Affected versions
- >= v9.0.19, <= v9.0.19 or >= v8.0.30, <= v8.0.30 or >= v11.0.0-preview.7, <= v11.0.0-preview.7 or >= v10.0.11, <= v10.0.11 or >= v9.0.18, <= v9.0.18 or >= v8.0.29, <= v8.0.29 or >= v11.0.0-preview.6, <= v11.0.0-preview.6 or >= v10.0.10, <= v10.0.10 or >= v9.0.17, <= v9.0.17 or >= v11.0.0-preview.5, <= v11.0.0-preview.5 or >= v10.0.9, <= v10.0.9 or >= v8.0.28, <= v8.0.28 or >= v11.0.0-preview.4, <= v11.0.0-preview.4 or >= v9.0.16, <= v9.0.16 or >= v8.0.27, <= v8.0.27 or >= v10.0.8, <= v10.0.8 or >= v10.0.7, <= v10.0.7 or >= v11.0.0-preview.3, <= v11.0.0-preview.3 or >= v10.0.6, <= v10.0.6 or >= v9.0.15, <= v9.0.15 or >= v8.0.26, <= v8.0.26 or >= v10.0.5, <= v10.0.5 or >= v9.0.14, <= v9.0.14 or >= v8.0.25, <= v8.0.25 or >= v11.0.0-preview.2, <= v11.0.0-preview.2 or >= v10.0.4, <= v10.0.4 or >= v11.0.0-preview.1, <= v11.0.0-preview.1 or >= v9.0.13, <= v9.0.13 or >= v8.0.24, <= v8.0.24 or >= v10.0.3, <= v10.0.3 or >= v9.0.12, <= v9.0.12 or >= v8.0.23, <= v8.0.23 or >= v10.0.2, <= v10.0.2 or >= v10.0.1, <= v10.0.1 or >= v9.0.11, <= v9.0.11 or >= v8.0.22, <= v8.0.22 or >= v10.0.0, <= v10.0.0
- Patched version
- 18.9.0-beta1.26405.2
An early warning has been issued for a critical vulnerability in Microsoft.DiaSymReader.Native that could lead to remote code execution in.NET projects using affected versions.
What happened
Microsoft.DiaSymReader.Native reportedly contains a vulnerability that allows for an out of bounds write when processing MSFZ PDB files. This could result in a remote code execution vulnerability. The affected versions span a wide range, from v8.0.22 to v11.0.0-preview.7. This vulnerability has a CVSS score of 8.8, indicating high severity.
The vulnerability, tracked as CVE-2026-71328 and GHSA-63GH-G2X5-X69V, is under investigation. It is not yet confirmed to be exploited in the wild, and no supply-chain attack has been reported. The issue was first flagged on September 9, 2026.
What to do about it
- Review your.NET projects to identify if they are using any of the affected versions of Microsoft.DiaSymReader.Native.
- If your projects are using an affected version, upgrade to the patched version 18.9.0-beta1.26405.2 of Microsoft.DiaSymReader.Native.
- Monitor the primary sources for updates on the vulnerability and any additional mitigation advice.
How 0Day would have caught this
Microsoft.DiaSymReader.Native is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if your .NET projects use any version of Microsoft.DiaSymReader.Native from v8.0.22 to v11.0.0-preview.7, inclusive.
What should I do right now?
Immediately check your.NET projects for the affected versions of Microsoft.DiaSymReader.Native and upgrade to the patched version 18.9.0-beta1.26405.2 if necessary.
Is there an official fix available?
Yes, the patched version 18.9.0-beta1.26405.2 is available. Upgrade to this version to mitigate the vulnerability.