Junglewise Threat Intelligence

CVE-2026-50646: Microsoft .NET Framework protection mechanism failure

CVE-2026-50646 · Severity: high · CVSS 7.8 · Published 2026-07-14

Executive brief

Windows Presentation Foundation (WPF), a framework used to build Windows desktop applications, contains a vulnerability that allows attackers to execute arbitrary code when an application processes specially crafted XAML files. An attacker could trick a user into opening a malicious XAML file or manipulate application data to trigger the vulnerability, resulting in complete system compromise under the current user's privileges.

Technical details

The vulnerability is a protection mechanism failure (CWE-693) in WPF's XAML parser that fails to properly sanitize or validate untrusted XAML markup before processing. The attack vector is local with user interaction required—an attacker must provide specially crafted XAML input that a WPF application processes. Affected versions include .NET 8.0.0 through 8.0.28, .NET 9.0.0 through 9.0.17, and .NET 10.0.0 through 10.0.9. Successful exploitation allows arbitrary code execution with the privileges of the user running the application. Patches are available via updated NuGet packages (Microsoft.WindowsDesktop.App.Runtime) targeting the patched versions 8.0.29, 9.0.18, and 10.0.10. Applications using self-contained deployments must be recompiled and redeployed.

Affected products

  • Microsoft Windows Presentation Foundation (WPF) .NET 8.0.0–8.0.28, .NET 9.0.0–9.0.17, .NET 10.0.0–10.0.9
  • Microsoft Microsoft.WindowsDesktop.App.Runtime.win-arm64 8.0.0–8.0.28, 9.0.0–9.0.17, 10.0.0–10.0.9
  • Microsoft Microsoft.WindowsDesktop.App.Runtime.win-x64 8.0.0–8.0.28, 9.0.0–9.0.17, 10.0.0–10.0.9
  • Microsoft Microsoft.WindowsDesktop.App.Runtime.win-x86 8.0.0–8.0.28, 9.0.0–9.0.17, 10.0.0–10.0.9

Timeline

  • 2026-07-14: disclosed: Advisory published
  • 2026-07-14: patched: Patches available: .NET 8.0.29, 9.0.18, 10.0.10

References

Related threats