Executive brief
A vulnerability exists in Windows Presentation Foundation (WPF), a framework used for building desktop applications in .NET. An attacker could use a specially crafted document to trick the application into accessing unauthorized resources or disclosing sensitive information over the network. This could lead to the exposure of internal data if a user is persuaded to open a malicious file.
Technical details
An information disclosure vulnerability exists in Windows Presentation Foundation (WPF) due to improper handling of untrusted functionality during document parsing. The flaw is categorized under CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) and CWE-918 (Server-Side Request Forgery). An unauthenticated remote attacker can exploit this by inducing a user to open a specially crafted document, triggering the inclusion of external functionality that allows the attacker to disclose information over the network. The vulnerability affects .NET 8, 9, and 10. Patches are available in .NET versions 8.0.30, 9.0.19, and 10.0.11.
Affected products
- Microsoft Windows Presentation Foundation (WPF) .NET 10: >= 10.0.0, <= 10.0.10; .NET 9: >= 9.0.0, <= 9.0.18; .NET 8: >= 8.0.0, <= 8.0.29
Timeline
- 2026-08-11: disclosed
- 2026-08-11: patched