Executive brief
A security vulnerability exists in Windows Presentation Foundation (WPF), a framework used for building Windows desktop applications. An attacker could potentially execute malicious code on a user's computer if the user interacts with a specially crafted application. This could lead to a full system compromise, unauthorized data access, or service disruption.
Technical details
An integer overflow or wraparound vulnerability (CWE-190) exists in the Windows Presentation Foundation (WPF) component of .NET. The flaw is triggered when the software performs a calculation that produces a value exceeding its storage capacity, leading to memory corruption. An attacker can exploit this by convincing a user to run a malicious application or open a crafted file, resulting in local code execution with the privileges of the current user. The attack requires user interaction and has high complexity due to the nature of the overflow. Patches are available in .NET versions 8.0.30, 9.0.19, and 10.0.11.
Affected products
- Microsoft .NET 10.0.0 - 10.0.10 >= 10.0.0, <= 10.0.10
- Microsoft .NET 9.0.0 - 9.0.18 >= 9.0.0, <= 9.0.18
- Microsoft .NET 8.0.0 - 8.0.29 >= 8.0.0, <= 8.0.29
- Microsoft Windows Presentation Foundation (WPF) Included in affected .NET versions
Timeline
- 2026-08-11: advisory: Initial advisory publication by Microsoft and GitHub
- 2026-08-11: patched: Patched versions released for .NET 8, 9, and 10