# CVE-2026-50650: Microsoft .NET Framework code injection privilege escalation

Source: https://junglewise.ai/threats/cve-2026-50650-microsoft-net-framework-code-injection-privilege-escalation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-14. Updated: 2026-07-21  
License: CC BY 4.0 with a link back

CVE-2026-50650 · Severity: high · CVSS 7.8 · Published 2026-07-14

A security vulnerability exists in the Windows Presentation Foundation (WPF) framework, which is used by developers to build visual interfaces for Windows applications. An attacker could use a specially crafted file to gain higher-level permissions on a user's computer. This could allow an unauthorized person to perform actions they normally wouldn't have permission to do, potentially compromising the security of the entire system.

Technologies: [Microsoft .NET Framework](https://junglewise.ai/threats/technologies/net-framework), [Microsoft Windows Presentation Foundation](https://junglewise.ai/threats/technologies/windows-presentation-foundation), [Microsoft.WindowsDesktop.App.Runtime.win-arm64 (NuGet)](https://junglewise.ai/threats/technologies/microsoft-windowsdesktop-app-runtime-win-arm64), [Microsoft.WindowsDesktop.App.Runtime.win-x64 (NuGet)](https://junglewise.ai/threats/technologies/microsoft-windowsdesktop-app-runtime-win-x64), [Microsoft.WindowsDesktop.App.Runtime.win-x86 (NuGet)](https://junglewise.ai/threats/technologies/microsoft-windowsdesktop-app-runtime-win-x86). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft), [NuGet](https://junglewise.ai/threats/vendors/nuget).

## Quick answers

**Is CVE-2026-50650 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50650 being exploited in the wild.

**How severe is CVE-2026-50650?** High severity, with a CVSS score of 7.8, published 14 July 2026.

**Which products and versions are affected?** Microsoft .NET Framework < 2.0.50727.8983 & 3.0.30729.8978; Microsoft Windows Presentation Foundation .NET 8, .NET 9, .NET 10; Microsoft.WindowsDesktop.App.Runtime.win-arm64 (NuGet) ECOSYSTEM:introduced=10.0.0,fixed=10.0.10; Microsoft.WindowsDesktop.App.Runtime.win-x64 (NuGet) ECOSYSTEM:introduced=10.0.0,fixed=10.0.10; and 1 more.

**Is there a fix for CVE-2026-50650?** Yes. Microsoft.WindowsDesktop.App.Runtime.win-arm64 (NuGet): upgrade to 10.0.10 or later; Microsoft.WindowsDesktop.App.Runtime.win-x64 (NuGet): upgrade to 10.0.10 or later; Microsoft.WindowsDesktop.App.Runtime.win-x86 (NuGet): upgrade to 10.0.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-50650 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-50650?** Check whether you run Microsoft .NET Framework, Microsoft Windows Presentation Foundation, Microsoft.WindowsDesktop.App.Runtime.win-arm64 (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Microsoft.WindowsDesktop.App.Runtime.win-arm64 (NuGet): upgrade to 10.0.10 or later

  ```sh
  dotnet add package Microsoft.WindowsDesktop.App.Runtime.win-arm64 --version 10.0.10
  ```

- Microsoft.WindowsDesktop.App.Runtime.win-x64 (NuGet): upgrade to 10.0.10 or later

  ```sh
  dotnet add package Microsoft.WindowsDesktop.App.Runtime.win-x64 --version 10.0.10
  ```

- Microsoft.WindowsDesktop.App.Runtime.win-x86 (NuGet): upgrade to 10.0.10 or later

  ```sh
  dotnet add package Microsoft.WindowsDesktop.App.Runtime.win-x86 --version 10.0.10
  ```


## Technical details

An elevation of privilege vulnerability exists in Windows Presentation Foundation (WPF) within .NET 8, .NET 9, and .NET 10. The issue is classified as a code injection vulnerability (CWE-94) occurring during the parsing of specially crafted XAML input. To exploit this, an attacker would typically need to convince a user to open a malicious file or run a malicious application locally. Successful exploitation allows the attacker to execute code with elevated privileges on the affected Windows system. Microsoft has released patches for .NET 8 (8.0.29), .NET 9 (9.0.18), and .NET 10 (10.0.10) to address this flaw.

## Affected products

- Microsoft .NET 8.0.0-8.0.28, 9.0.0-9.0.17, 10.0.0-10.0.9
- Microsoft Windows Presentation Foundation (WPF) .NET 8, .NET 9, .NET 10

## Identifiers

- CVE-2026-50650
- GHSA-2969-4q4w-w5h3

## Timeline

- 2026-07-14: disclosed: Advisory published by Microsoft
- 2026-07-14: patched: Patched versions released for .NET 8, 9, and 10
- 2026-07-21: advisory: GitHub Advisory reviewed and updated

## References

- [https://github.com/dotnet/wpf/security/advisories/GHSA-2969-4q4w-w5h3](https://github.com/dotnet/wpf/security/advisories/GHSA-2969-4q4w-w5h3)
- [https://github.com/dotnet/announcements/issues/421](https://github.com/dotnet/announcements/issues/421)
- [https://github.com/dotnet/wpf/issues/11784](https://github.com/dotnet/wpf/issues/11784)
- [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50650](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50650)
- [https://api.github.com/repos/dotnet/wpf/security-advisories/GHSA-2969-4q4w-w5h3](https://api.github.com/repos/dotnet/wpf/security-advisories/GHSA-2969-4q4w-w5h3)

## Related threats

- [Microsoft Active Directory Federation Services information disclosure](https://junglewise.ai/threats/cve-2026-97788-observable-discrepancy-in-active-directory-federation-services-ad)
- [Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.](https://junglewise.ai/threats/cve-2026-96960-microsoft-security-advisory-net-and-visual-studio-denial-of)
- [Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.](https://junglewise.ai/threats/cve-2026-96959-microsoft-security-advisory-net-and-visual-studio-denial-of)
- [Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.](https://junglewise.ai/threats/cve-2026-96235-microsoft-security-advisory-net-and-visual-studio-remote-code)
- [Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.](https://junglewise.ai/threats/cve-2026-96234-microsoft-security-advisory-net-and-visual-studio-information)