Heap-based buffer overflow in Microsoft products - CVE-2026-69439
Published: September 8, 2026
Vulnerability identifier: #VU147695
CSH Severity: High
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-69439
CWE-ID: CWE-122
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute code with the privileges of the affected process.
The vulnerability exists due to a heap-based buffer overflow in .NET and Visual Studio when processing a specially crafted Portable PDB file. A remote attacker can convince a user or service to process a specially crafted Portable PDB file to execute code with the privileges of the affected process.
Affected software
.NET
Visual Studio
Microsoft .NET Framework
Visual Studio
Microsoft .NET Framework
How to mitigate CVE-2026-69439
Install security update from vendor's website.
.NET - addressed in versions 8.0.31, 9.0.20
Visual Studio - update to 17.14.40
Microsoft .NET Framework - update to 10.0.12
Visual Studio - update to 17.14.40
Microsoft .NET Framework - update to 10.0.12