{"vulnerability": "ghsa-2j8r-3c22-8565", "sightings": [{"uuid": "869dd41e-4ca4-44dd-9661-eef70eb0c791", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-2j8r-3c22-8565", "type": "seen", "source": "https://gist.github.com/ViveliDuCh/de46bd2e75cb209d3e5ba8ceaac367db", "content": "# Known Build Error Issue Drafts \u2014 PR dotnet/runtime#133336\n\nContext: PR #133336 (\"[release/10.0] Update dependencies from dotnet/xharness\") is a pure Maestro/darc dependency-flow PR.\nIts diff only touches `.config/dotnet-tools.json`, `eng/Version.Details.props`, and `eng/Version.Details.xml`,\nbumping `Microsoft.DotNet.XHarness.*` from `11.0.0-prerelease.26428.1` to `11.0.0-prerelease.26451.1`.\nNeither failure below touches code related to that bump \u2014 both are pre-existing/unrelated to the PR's changes.\n\nNo existing open GitHub issue was found tracking either failure (searched dotnet/runtime and dotnet-org-wide).\n\n---\n\n## Issue 1 \u2014 NU1903: Microsoft.DiaSymReader.Native known vulnerability (Repository Known Issue)\n\n### Build Information\nBuild: https://dev.azure.com/dnceng-public/public/_build/results?buildId=1585246&view=logs&j=2803472c-98a9-5b1b-9de9-ae07145fd715&t=7658dcdd-0997-5df2-43a3-3657d2206cf9&s=ff05ad62-bb9a-53b6-ce9f-72f329a63e7c\nLeg Name: \n\n### Error Message\n```json\n{\n    \"ErrorMessage\": \"Package 'Microsoft.DiaSymReader.Native' 17.12.0-beta1.24603.5 has a known high severity vulnerability\",\n    \"BuildRetry\": false,\n    \"ErrorPattern\": \"\",\n    \"ExcludeConsoleLog\": false\n}\n```\n\n### Notes for the issue body\n- Repo: dotnet/runtime (label: `Known Build Error`, plus `area-Infrastructure-libraries` or the relevant installer/sfx area label)\n- Root cause: `src/installer/pkg/sfx/Microsoft.NETCore.App/Microsoft.NETCore.App.Runtime.CoreCLR.sfxproj` and `Microsoft.NETCore.App.Ref.sfxproj` reference `Microsoft.DiaSymReader.Native` 17.12.0-beta1.24603.5, which now has two published GitHub advisories:\n  - https://github.com/advisories/GHSA-2j8r-3c22-8565\n  - https://github.com/advisories/GHSA-527h-q9f6-p7qx\n  NuGetAudit treats these as build errors (Warning As Error) once the advisory database picks them up \u2014 unrelated to any specific PR's code changes.\n- Fix: bump the pinned `Microsoft.DiaSymReader.Native` package version (via eng/Versions.props / Version.Details.xml, or a source-build/darc dependency update) to a patched version, or suppress the specific advisory only if a patched version isn't yet available.\n\n---\n\n## Issue 2 \u2014 readytorun/tests/mainv1 & mainv2: DllNotFoundException on windows.11.arm64.open (needs triage: Infra vs Repo)\n\n### Build Information\nBuild/Helix log: https://helixr18s23ayyeko0k025g8.blob.core.windows.net/dotnet-runtime-refs-pull-133336-merge-2c1c2d3d0dc24961b7/readytorun/1/console.814e196a.log?helixlogtype=result\nLeg Name: readytorun (Queue: windows.11.arm64.open)\n\n### Error Message\n```json\n{\n    \"ErrorMessage\": [\"Running test: readytorun/tests/mainv1/mainv1.cmd\", \"System.DllNotFoundException: Unable to load DLL 'nativelibrary' or one of its dependencies: The specified module could not be found. (0x8007007E)\"],\n    \"BuildRetry\": false,\n    \"ErrorPattern\": \"\",\n    \"ExcludeConsoleLog\": false\n}\n```\n\n### Notes for the issue body\n- Repo: dotnet/runtime (label: `Known Build Error`, `area-Infrastructure-coreclr`)\n- Both `mainv1.cmd` and `mainv2.cmd` (Interop/native-interop subtests inside the `readytorun` test suite) fail identically with\n  `Unhandled exception. System.DllNotFoundException: Unable to load DLL 'nativelibrary' ... (0x8007007E)` at `MyClass.NativeMethod()`,\n  causing `Actual: -532462766` instead of the expected `100` \u2014 this is an unhandled native exception surfacing as that HRESULT, not a managed logic failure.\n- Prior mainv1/mainv2 \"Test failure\" issues (#116360, #109500, #85442, #73138, #54203, #8672, etc.) are all closed/stale and don't match this exact signature or queue.\n- Likely cause: the native test-native-library asset (`nativelibrary.dll`) isn't being deployed/found alongside the test payload on the `windows.11.arm64.open` Helix queue \u2014 worth confirming whether this queue is new/recently added and whether the test's native dependency copy step handles arm64 correctly.\n- Recommend filing as a **repository issue** first (readytorun test harness deployment), escalate to `dotnet/dnceng` as **Infrastructure Known Issue** if it turns out to be a Helix payload/queue-image problem affecting other suites too.\n\n---\nReference: https://github.com/dotnet/arcade/blob/main/Documentation/Build%20Analysis/KnownIssues.md\n", "creation_timestamp": "2026-09-11T15:21:26.998071Z"}]}