JEDI-SEC | Security Research & Digital Defense

GHSA-r8h3-p8p6-ggp7: Microsoft Security Advisory CVE-2026-114158 – Visual Studio Remote Code Execution Vulnerability

Written by

jedisec_u136k7

in

  • Severity: HIGH
  • CVE: CVE-2026-114158
  • Ecosystems: nuget, nuget, nuget, nuget, nuget, nuget, nuget, nuget, nuget, nuget, nuget, nuget
  • Packages: Microsoft.NETCore.App.Runtime.win-x86, Microsoft.NETCore.App.Runtime.win-x64, Microsoft.NETCore.App.Runtime.win-arm64, Microsoft.NETCore.App.Runtime.win-x86, Microsoft.NETCore.App.Runtime.win-x64, Microsoft.NETCore.App.Runtime.win-arm64, Microsoft.NETCore.App.Runtime.win-x86, Microsoft.NETCore.App.Runtime.win-x64, Microsoft.NETCore.App.Runtime.win-arm64, Microsoft.NETCore.App.Runtime.win-x86, Microsoft.NETCore.App.Runtime.win-x64, Microsoft.NETCore.App.Runtime.win-arm64

## Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components.

A Portable PDB `EmbeddedSource` record with parent RID 0 can trigger an out-of-bounds write.

## CVSS Details

– **Version:** 3.1
– **Severity:** High
– **Score:** 8.8 (base score)
– **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C`
– **Weakness:** CWE-122

## Affected Platforms

– **Platforms:** Windows
– **Architectures:** x86, x64, Arm64

## Affected Packages

Microsoft.DiaSymReader.Native components bundled with the affected .NET versions listed below are affected when initializing the native reader with a crafted Portable PDB containing an `EmbeddedSource` record with parent RID 0. The Windows runtime’s native stack-trace reader can reach this initialization through its native-reader fallback.

### .NET on Windows

Product | Affected version | Patched version
— | — | —
.NET 8.0 installed on Windows | >= 8.0.0, < 8.0.34 | 8.0.34
.NET 9.0 installed on Windows | >= 9.0.0, < 9.0.23 | 9.0.23
.NET 10.0 installed on Windows | >= 10.0.0, < 10.0.15 | 10.0.15
.NET 11.0 installed on Windows | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0

### Windows runtime packages for self-contained applications

The following packages deliver the affected .NET native reader. Exposure requires the PDB-reading operation described above; the presence of the reader does not m…

Source: GitHub Security Advisories · 2026-11-11

More posts