Microsoft Security Advisory CVE-2026-114159

Advisories.Gitlab • November 12, 2026

Microsoft is releasing this security advisory to provide information a vulnerability in .NET. This advisory provides guidance on updating affected applications and components.

An oversized Portable PDB document name can be truncated during allocation and cause a heap out-of-bounds write.

github.com /advisories/GHSA-3cgx-w6gm-fqrx

github.com /dotnet/announcements/issues/521

github.com /dotnet/core/blob/main/release-notes/10.0/10.0.15/10.0.15.md

github.com /dotnet/core/blob/main/release-notes/11.0/11.0.0/11.0.0.md

github.com /dotnet/core/blob/main/release-notes/8.0/8.0.34/8.0.34.md

github.com /dotnet/core/blob/main/release-notes/9.0/9.0.23/9.0.23.md

github.com /dotnet/core/releases/tag/v11.0.0

github.com /dotnet/runtime/issues/137296

github.com /dotnet/runtime/releases/tag/v10.0.15

github.com /dotnet/runtime/releases/tag/v8.0.34

github.com /dotnet/runtime/releases/tag/v9.0.23

github.com /dotnet/runtime/security/advisories/GHSA-3cgx-w6gm-fqrx

msrc.microsoft.com /update-guide/vulnerability/CVE-2026-114159

nvd.nist.gov /vuln/detail/CVE-2026-114159

Code Behaviors & Features

Detect and mitigate CVE-2026-114159 with GitLab Dependency Scanning

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Microsoft Discloses High-Risk .NET Vulnerability CVE-2026-114159 Microsoft has released a security advisory for CVE-2026-114159, a high-severity vulnerability in.NET that allows for remote code execution due to an oversized Portable PDB document name causing a heap out-of-bounds write. The vulnerability affects applications using the Microsoft.DiaSymReader.Native components bundled with specific.NET versions on Windows x86, x64, and Arm64 architectures. The CVSS score for this vulnerability is 8.8, indicating a high level of risk. Users are advised to update their.NET installations and SDKs to mitigate the risk. The advisory was published on November 10, 2026, and the issue is linked to the Windows runtime's native stack-trace reader. No has been reported at this time, but users should act promptly to apply the necessary updates. 2 sources 63

Extracted Entities

Microsoft Security Advisory CVE-2026-114159

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Domains (1)