Heap-based buffer overflow in Microsoft products - CVE-2026-69439

Vulnerability identifier: #VU147695

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-69439

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute code with the privileges of the affected process.

The vulnerability exists due to a heap-based buffer overflow in .NET and Visual Studio when processing a specially crafted Portable PDB file. A remote attacker can convince a user or service to process a specially crafted Portable PDB file to execute code with the privileges of the affected process.

.NET
Visual Studio
Microsoft .NET Framework
Fedora
dotnet8.0
dotnet9.0
dotnet10.0

Install security update from vendor's website.

.NET - addressed in versions 8.0.31, 9.0.20
Visual Studio - update to 17.14.40
Microsoft .NET Framework - update to 10.0.12
dotnet8.0 - addressed in versions 8.0.131-1.fc43, 8.0.131-1.fc44
dotnet9.0 - addressed in versions 9.0.121-1.fc43, 9.0.121-1.fc44
dotnet10.0 - addressed in versions 10.0.112-1.fc43, 10.0.112-1.fc44, 10.0.112-1.fc45

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69439

• Multiple vulnerabilities in Visual Studio
• Fedora 45 update for dotnet10.0
• Fedora 44 update for dotnet9.0
• Fedora 43 update for dotnet10.0
• Fedora 44 update for dotnet10.0
• Fedora 43 update for dotnet9.0
• Fedora 43 update for dotnet8.0
• Fedora 44 update for dotnet8.0