Executive brief
A security vulnerability has been identified in Microsoft's Windows Presentation Foundation (WPF), a framework used for building Windows desktop applications. An attacker could exploit this flaw to gain higher-level system permissions on a local machine, potentially allowing them to access sensitive data or modify system settings. This issue requires a user to perform a specific action, such as opening a malicious file, to trigger the exploit. Organizations should update their .NET runtimes and recompile any self-contained applications to mitigate this risk.
Technical details
A vulnerability exists in Windows Presentation Foundation (WPF) within .NET 8, 9, and 10 due to an integer overflow (CWE-190) that leads to a heap-based buffer overflow (CWE-122). The flaw is triggered when the application performs calculations that result in a wraparound, allowing an attacker to overwrite memory in the heap. While the attack vector is local, it requires no prior privileges (PR:N) but does necessitate user interaction (UI:R). Successful exploitation allows an unauthorized attacker to elevate their privileges on the local system. Microsoft has released patches for .NET 8 (8.0.30), .NET 9 (9.0.19), and .NET 10 (10.0.11). Developers using self-contained deployments must recompile and redeploy their applications.
Affected products
- Microsoft Windows Presentation Foundation (WPF) 8.0.0 to 8.0.29, 9.0.0 to 9.0.18, 10.0.0 to 10.0.10
- Microsoft .NET 8.0, 9.0, 10.0
Timeline
- 2026-08-11: disclosed
- 2026-08-11: advisory
- 2026-08-11: patched