JEDI-SEC | Security Research & Digital Defense

GHSA-fpxj-5c99-g7vj: Microsoft Security Advisory CVE-2026-114151 – Visual Studio Remote Code Execution Vulnerability

Written by

jedisec_u136k7

in

  • Severity: HIGH
  • CVE: CVE-2026-114151
  • Ecosystems: nuget, nuget, nuget, nuget, nuget, nuget, nuget, nuget, nuget, nuget, nuget, nuget
  • Packages: Microsoft.NETCore.App.Runtime.win-x86, Microsoft.NETCore.App.Runtime.win-x64, Microsoft.NETCore.App.Runtime.win-arm64, Microsoft.NETCore.App.Runtime.win-x86, Microsoft.NETCore.App.Runtime.win-x64, Microsoft.NETCore.App.Runtime.win-arm64, Microsoft.NETCore.App.Runtime.win-x86, Microsoft.NETCore.App.Runtime.win-x64, Microsoft.NETCore.App.Runtime.win-arm64, Microsoft.NETCore.App.Runtime.win-x86, Microsoft.NETCore.App.Runtime.win-x64, Microsoft.NETCore.App.Runtime.win-arm64

## Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components.

A crafted PDB `LF_DECIMAL` payload can trigger an out-of-bounds stack write when processed by DIA.

## CVSS Details

– **Version:** 3.1
– **Severity:** High
– **Score:** 8.8 (base score)
– **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C`
– **Weakness:** CWE-502, CWE-121

## Affected Platforms

– **Platforms:** Windows
– **Architectures:** x86, x64, Arm64

## Affected Packages

Microsoft.DiaSymReader.Native versions earlier than 18.9.1-beta1.26515.1 are affected when reading constants from attacker-supplied PDBs through `ISymUnmanagedConstant.GetValue`. The .NET runtime’s native stack-trace reading path does not call `ISymUnmanagedConstant.GetValue`. This excludes that invocation, not the .NET product as a whole.

### .NET on Windows

Product | Affected version | Patched version
— | — | —
.NET 8.0 installed on Windows | >= 8.0.0, < 8.0.34 | 8.0.34
.NET 9.0 installed on Windows | >= 9.0.0, < 9.0.23 | 9.0.23
.NET 10.0 installed on Windows | >= 10.0.0, < 10.0.15 | 10.0.15
.NET 11.0 installed on Windows | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0

### Windows self-contained runtime packs

These runtime packs deliver the .NET runtime for Windows self-contained applications.

Package | Affected version | Patched version
— | — | —
[Microsoft.NETCore.…

Source: GitHub Security Advisories · 2026-11-11

More posts