Threats tagged 'ghsa-fpxj-5c99-g7vj'

A high-severity vulnerability (CVE-2026-114151) exists in Microsoft.DiaSymReader.Native versions prior to 18.9.1-beta1.26515.1 used by certain .NET runtimes on Windows. The flaw involves an out-of-bounds stack write triggered by a crafted PDB LF_DECIMAL payload processed through ISymUnmanagedConstant.GetValue. This affects .NET runtime versions 8.0.0 up to but not including 8.0.34, 9.0.0 up to 9.0.23, 10.0.0 up to 10.0.15, and 11.0.0-preview.1 up to 11.0.0 on Windows x86, x64, and Arm64 architectures. The native stack-trace reading path in .NET does not invoke the vulnerable method, so not all .NET usage is affected. Patches are available in the specified fixed versions.