VYPR
← All advisories
High severity8.8NVD Advisory· Published Sep 8, 2026· Updated Sep 11, 2026

CVE-2026-71328

CVE-2026-71328

Description

Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
Microsoft.DiaSymReader.NativeNuGet
>= 17.10.0-beta1.24272.1, < 18.9.0-beta1.26405.218.9.0-beta1.26405.2

Affected products

13
  • Microsoft/Visual Studiollm-fuzzy3 versions
    (expand)+ 2 more
    • (no CPE)
    • cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:-:*:*range: >=17.14.0,<17.14.40
    • cpe:2.3:a:microsoft:visual_studio_2026:*:*:*:*:*:*:*:*range: >=18.9.0,<18.9.3
  • osv-coords2 versions
    pkg:bitnami/dotnetpkg:bitnami/dotnet-sdk
    >= 8.0.0, < 8.0.31+ 1 more
    • (no CPE)range: >= 8.0.0, < 8.0.31
    • (no CPE)range: >= 8.0.0, < 8.0.31
  • Microsoft/Net8 versions
    cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*+ 7 more
    • cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*range: >=8.0.0,<8.0.31
    • cpe:2.3:a:microsoft:.net:11.0.0:preview1:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:.net:11.0.0:preview2:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:.net:11.0.0:preview3:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:.net:11.0.0:preview4:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:.net:11.0.0:preview5:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:.net:11.0.0:preview6:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:.net:11.0.0:preview7:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

4

News mentions

2