CVE-2026-69439 .NET and Visual Studio Elevation of Privilege Vulnerability

High 8.8 Published 8 Sep 2026 Updated 14 Oct 2026

Heap-based buffer overflow in .NET and Visual Studio allows network attackers to elevate privileges.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-69439?

CVE-2026-69439 is a high-severity memory corruption vulnerability in Microsoft .Net, published on 8 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Heap-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.

Weakness: CWE-122

Which versions are affected by CVE-2026-69439?

4 open source packages ship an affected version, including Microsoft.DiaSymReader.Native, dotnet and dotnet-sdk. It affects 3 products.

Package	Affected	Fixed in
`Microsoft.DiaSymReader.Native` NuGet	From `17.10.0-beta1.24272.1`	`18.9.0-beta1.26405.2`
`Microsoft.DiaSymReader.Native` NuGet	From `17.10.0-beta1.24272.1`	`18.9.0-beta1.26405.2`
`dotnet` Bitnami	From `8.0.0`	`8.0.31, 9.0.20, 10.0.12`
`dotnet-sdk` Bitnami	From `8.0.0`	`8.0.31, 9.0.20, 10.0.12`

Products include Microsoft .Net, Microsoft Visual Studio 2022, Microsoft Visual Studio 2026.

How do I fix CVE-2026-69439?

Upgrade Microsoft.DiaSymReader.Native to 18.9.0-beta1.26405.2 or later.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-69439 being exploited?

There is no known exploitation of CVE-2026-69439 in the wild and no public exploit code.

All Microsoft .Net vulnerabilities

Sources

Also known as BELL-CVE-2026-69439, BIT-dotnet-2026-69439, BIT-dotnet-sdk-2026-69439, GHSA-527h-q9f6-p7qx, MINI-cmq9-xpcp-93mr, MINI-v9g9-cxr9-9v6j and 1 more.