High-Severity RCE Vulnerability in dotnet/runtime: CVE-2026-71328

The dotnet/runtime project has disclosed a high-severity remote code execution vulnerability, tracked as CVE-2026-71328, according to the GitHub Security Advisory database. The issue arises from an out-of-bounds write in Microsoft.DiaSymReader.Native while processing MSFZ PDB files. This vulnerability affects all architectures on Windows platforms and has a CVSS score of 8.8, indicating significant potential impact.

The affected package versions include Microsoft.DiaSymReader.Native versions starting from 17.10.0-beta1.24272.1 for .NET 10, and 17.12.0-beta1.24603.5 for .NET 8, 9, and 11 RC1. Patched versions are available, and developers are advised to update their applications to mitigate the risk.

Operators should carefully audit their dependency trees to identify whether any projects rely on the vulnerable versions of Microsoft.DiaSymReader.Native. Special attention should be paid to transitive dependencies, as these may introduce the vulnerability indirectly. Additionally, testing should be conducted to ensure that upgrading to the patched versions does not disrupt existing workflows or introduce compatibility issues, particularly for applications that handle MSFZ PDB files.