CVE-2026-50650: Microsoft .NET Framework code injection privilege escalation

CVE-2026-50650 · Severity: high · CVSS 7.8 · Published 2026-07-14

A security vulnerability exists in the Windows Presentation Foundation (WPF) framework, which is used by developers to build visual interfaces for Windows applications. An attacker could use a specially crafted file to gain higher-level permissions on a user's computer. This could allow an unauthorized person to perform actions they normally wouldn't have permission to do, potentially compromising the security of the entire system.

Technologies: Microsoft .NET Framework, Microsoft Windows Presentation Foundation, Microsoft.WindowsDesktop.App.Runtime.win-arm64 (NuGet), Microsoft.WindowsDesktop.App.Runtime.win-x64 (NuGet), Microsoft.WindowsDesktop.App.Runtime.win-x86 (NuGet). Vendors: Microsoft, NuGet.

Quick answers

Is CVE-2026-50650 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-50650 being exploited in the wild.
How severe is CVE-2026-50650?
High severity, with a CVSS score of 7.8, published 14 July 2026.
Which products and versions are affected?
Microsoft .NET Framework < 2.0.50727.8983 & 3.0.30729.8978; Microsoft Windows Presentation Foundation .NET 8, .NET 9, .NET 10; Microsoft.WindowsDesktop.App.Runtime.win-arm64 (NuGet) ECOSYSTEM:introduced=10.0.0,fixed=10.0.10; Microsoft.WindowsDesktop.App.Runtime.win-x64 (NuGet) ECOSYSTEM:introduced=10.0.0,fixed=10.0.10; and 1 more.
Is there a fix for CVE-2026-50650?
Yes. Microsoft.WindowsDesktop.App.Runtime.win-arm64 (NuGet): upgrade to 10.0.10 or later; Microsoft.WindowsDesktop.App.Runtime.win-x64 (NuGet): upgrade to 10.0.10 or later; Microsoft.WindowsDesktop.App.Runtime.win-x86 (NuGet): upgrade to 10.0.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50650 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-50650?
Check whether you run Microsoft .NET Framework, Microsoft Windows Presentation Foundation, Microsoft.WindowsDesktop.App.Runtime.win-arm64 (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Microsoft.WindowsDesktop.App.Runtime.win-arm64 (NuGet): upgrade to 10.0.10 or later
    dotnet add package Microsoft.WindowsDesktop.App.Runtime.win-arm64 --version 10.0.10
  • Microsoft.WindowsDesktop.App.Runtime.win-x64 (NuGet): upgrade to 10.0.10 or later
    dotnet add package Microsoft.WindowsDesktop.App.Runtime.win-x64 --version 10.0.10
  • Microsoft.WindowsDesktop.App.Runtime.win-x86 (NuGet): upgrade to 10.0.10 or later
    dotnet add package Microsoft.WindowsDesktop.App.Runtime.win-x86 --version 10.0.10

Technical details

An elevation of privilege vulnerability exists in Windows Presentation Foundation (WPF) within .NET 8, .NET 9, and .NET 10. The issue is classified as a code injection vulnerability (CWE-94) occurring during the parsing of specially crafted XAML input. To exploit this, an attacker would typically need to convince a user to open a malicious file or run a malicious application locally. Successful exploitation allows the attacker to execute code with elevated privileges on the affected Windows system. Microsoft has released patches for .NET 8 (8.0.29), .NET 9 (9.0.18), and .NET 10 (10.0.10) to address this flaw.

Affected products

  • Microsoft .NET 8.0.0-8.0.28, 9.0.0-9.0.17, 10.0.0-10.0.9
  • Microsoft Windows Presentation Foundation (WPF) .NET 8, .NET 9, .NET 10

Identifiers

  • CVE-2026-50650
  • GHSA-2969-4q4w-w5h3

Timeline

  • 2026-07-14: disclosed: Advisory published by Microsoft
  • 2026-07-14: patched: Patched versions released for .NET 8, 9, and 10
  • 2026-07-21: advisory: GitHub Advisory reviewed and updated

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.