JEDI-SEC | Security Research & Digital Defense

GHSA-x8x8-p968-x646: Microsoft Security Advisory CVE-2026-118745 – Visual Studio Remote Code Execution Vulnerability

Written by

jedisec_u136k7

in

  • Severity: HIGH
  • CVE: CVE-2026-118745
  • Ecosystems: nuget, nuget, nuget, nuget, nuget, nuget, nuget, nuget, nuget, nuget, nuget, nuget
  • Packages: Microsoft.NETCore.App.Runtime.win-x86, Microsoft.NETCore.App.Runtime.win-x64, Microsoft.NETCore.App.Runtime.win-arm64, Microsoft.NETCore.App.Runtime.win-x86, Microsoft.NETCore.App.Runtime.win-x64, Microsoft.NETCore.App.Runtime.win-arm64, Microsoft.NETCore.App.Runtime.win-x86, Microsoft.NETCore.App.Runtime.win-x64, Microsoft.NETCore.App.Runtime.win-arm64, Microsoft.NETCore.App.Runtime.win-x86, Microsoft.NETCore.App.Runtime.win-x64, Microsoft.NETCore.App.Runtime.win-arm64

## Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components.

Crafted PDB line metadata can exceed the caller-provided buffer and cause a heap out-of-bounds write.

## CVSS Details

– **Version:** 3.1
– **Severity:** High
– **Score:** 8.8 (base score)
– **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C`
– **Weakness:** CWE-122

## Affected Platforms

– **Platforms:** Windows
– **Architectures:** x86, x64, Arm64

## Affected Packages

On Windows x86, x64, and Arm64, Microsoft.DiaSymReader.Native versions earlier than 18.9.1-beta1.26515.1 are affected when reading crafted native PDBs.

### .NET on Windows

Product | Affected version | Patched version
— | — | —
.NET 8.0 installed on Windows | >= 8.0.0, < 8.0.34 | 8.0.34
.NET 9.0 installed on Windows | >= 9.0.0, < 9.0.23 | 9.0.23
.NET 10.0 installed on Windows | >= 10.0.0, < 10.0.15 | 10.0.15
.NET 11.0 installed on Windows | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0

### Windows self-contained runtime packs

These runtime packs deliver the .NET runtime for Windows self-contained applications.

Package | Affected version | Patched version
— | — | —
[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | >= 8.0.0, < 8.0.34 | 8.0.34
[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Micr…

Source: GitHub Security Advisories · 2026-11-11

More posts