Repository navigation
PostSharp 2026.0 ships Microsoft.DiaSymReader.Native 17.10.0-beta1.24272.1, which has three high-severity advisories #153
Description
The PostSharp compiler writes Windows PDBs with Microsoft.DiaSymReader.Native. The native DLLs of this package are
inside the compiler archive of the PostSharp package (build/PostSharp-Tools.7z), for x86, x64, ARM and ARM64, in both
the .NET Framework and the .NET compiler.
Three advisories, all rated high, affect Microsoft.DiaSymReader.Native >= 17.10.0-beta1.24272.1, <= 18.9.0-beta1.26405.1:
| Advisory | CVE | Title |
|---|---|---|
| GHSA-2j8r-3c22-8565 | CVE-2026-69522 | .NET and Visual Studio Remote Code Execution Vulnerability |
| GHSA-527h-q9f6-p7qx | CVE-2026-69439 | .NET and Visual Studio Elevation of Privilege Vulnerability |
| GHSA-63gh-g2x5-x69v | CVE-2026-71328 | .NET and Visual Studio Remote Code Execution Vulnerability |
The first patched version is 18.9.0-beta1.26405.2.
Affected PostSharp versions
| Line | Version of Microsoft.DiaSymReader.Native |
Affected |
|---|---|---|
| 2024.0 | 17.8.0-beta1.23475.2 |
No. This version is below the range of the advisories. |
| 2026.0 | 17.10.0-beta1.24272.1 |
Yes. Every published version, from 2026.0.1-preview to 2026.0.18. |
| 2027.0 | 17.10.0-beta1.24272.1 |
Yes. Not released yet. |
How this was established:
- The packages on nuget.org were inspected. The DLLs carry a file version, not the version of the package:
17.8.0-beta1.23475.2contains14.38.33030.0, and17.10.0-beta1.24272.1contains14.40.33810.0.- 2024.0.27 contains
14.38.33030.0. - 2026.0.1-preview and 2026.0.18 contain
14.40.33810.0. The x64 DLL of 2026.0.18 is identical, byte for byte, to
the one of17.10.0-beta1.24272.1.
- 2024.0.27 contains
- On
release/2026.0, the reference has been17.10.0-beta1.24272.1since 2025-01-09, before the first 2026.0
version. The later commits that touch it change only its formatting. - A version below the range is not affected by these three advisories. That does not show that it has no other
vulnerability.
Why users are not warned
The DLLs are inside the compiler archive. They are not a dependency of the package, so NuGet Audit does not report them
in a project that references PostSharp. PostSharp's own restore reports them as NU1903, and on develop/2027.0 the
three references suppress the warning with NoWarn="NU1903".
Blocker
The patched version 18.9.0-beta1.26405.2 is not published on nuget.org. On 2026-09-26, the most recent version there
is 18.8.4-beta1.26356.2, which is in the affected range. Every published version from 17.10.0-beta1.24272.1 on is in
the affected range.
Fix
When the patched version is published:
- Update the three references, in
PostSharp.Compiler.Engine,PostSharp.Compiler.Hosting.NetFrameworkand
PostSharp.MSBuild. - Remove the
NoWarn="NU1903". - Check that the compiler still writes Windows PDBs. Many projects under
Tests/Corebuild withDebugTypefull
orpdbonly. - Release a 2026.0 build with the patched version.
-- Claude for Gael Fraiteur
Metadata
Metadata
Assignees
Labels
Type
Projects
- Status
Activity
[-]The compiler ships Microsoft.DiaSymReader.Native 17.10.0-beta1.24272.1, which has three high-severity advisories[/-][+]PostSharp 2026.0 ships Microsoft.DiaSymReader.Native 17.10.0-beta1.24272.1, which has three high-severity advisories[/+]gfraiteur commentedon Sep 30, 2026
Status on 2026-09-30: still blocked.
Microsoft.DiaSymReader.Nativeon nuget.org is still18.8.4-beta1.26356.2, which is in the affected range.dotnet-toolsfeed (dnceng/public) has no version later than the 16.9 betas, so there is no other official source for18.9.0-beta1.26405.2.The fix also needs to update a fourth reference, which is not listed above:
Tests/Core/PostSharp.Core.Test.NetFramework/PostSharp.Core.Test.NetFramework.csproj. It has noNoWarnand is not shipped, but it should use the same version so that the tests load the DLLs that ship.-- Claude for Gael Fraiteur