Skip to content
Microsoft Discloses High-Risk .NET Vulnerability CVE-2026-114159

Microsoft Discloses High-Risk .NET Vulnerability CVE-2026-114159

First seen 12 Nov 2026, 13:18 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 12, 2026 at 13:19 UTC
  • •CVE-2026-114159 has a CVSS score of 8.8, indicating high severity.
  • •The vulnerability affects .NET applications on Windows x86, x64, and Arm64 architectures.
  • •Users are urged to update their .NET installations and SDKs to mitigate risks.

Microsoft has released a security advisory for CVE-2026-114159, a high-severity vulnerability in.NET that allows for remote code execution due to an oversized Portable PDB document name causing a heap out-of-bounds write. The vulnerability affects applications using the Microsoft.DiaSymReader.Native components bundled with specific.NET versions on Windows x86, x64, and Arm64 architectures. The CVSS score for this vulnerability is 8.8, indicating a high level of risk. Users are advised to update their.NET installations and SDKs to mitigate the risk. The advisory was published on November 10, 2026, and the issue is linked to the Windows runtime's native stack-trace reader. No has been reported at this time, but users should act promptly to apply the necessary updates.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 6h ago How this analysis works

Timeline

2026-11-10
CVE-2026-114159 published
Microsoft disclosed a high-severity vulnerability in .NET allowing remote code execution due to oversized PDB document names.
Github
2026-11-11
Security advisory released
Microsoft provided guidance on updating affected applications and components to address the vulnerability.
Github
2026-11-12
Consolidation of advisory feedback
An announcement was made to consolidate feedback regarding the .NET Runtime security advisory, retaining the original CVE post.
github.com

More articles in this cluster (4)

Following this threat?

Track Microsoft Corporation and CVE-2026-114159 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (8)

1 / 3

Common questions

Which .NET versions are affected?
The vulnerability affects .NET applications using Microsoft.DiaSymReader.Native components bundled with specific versions on Windows.
What is the risk associated with this vulnerability?
The vulnerability has a CVSS score of 8.8, indicating a high risk of remote code execution.
How can I mitigate this vulnerability?
Users should update their .NET installations and SDKs to the latest versions as recommended in the advisory.