CVE-2026-62902: Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to disclose information over a network.

CVE-2026-62902 · Severity: medium · CVSS 6.5 · Published 2026-08-11

A vulnerability exists in Windows Presentation Foundation (WPF), a framework used for building desktop applications in .NET. An attacker could use a specially crafted document to trick the application into accessing unauthorized resources or disclosing sensitive information over the network. This could lead to the exposure of internal data if a user is persuaded to open a malicious file.

Technologies: Microsoft Visual Studio 2022, Microsoft Visual Studio 2026, Microsoft Windows, Microsoft Windows Presentation Foundation, Microsoft.WindowsDesktop.App.Runtime.win-arm64 (NuGet), Microsoft.WindowsDesktop.App.Runtime.win-x64 (NuGet), Microsoft.WindowsDesktop.App.Runtime.win-x86 (NuGet). Vendors: Microsoft, NuGet.

Quick answers

Is CVE-2026-62902 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-62902 being exploited in the wild.
How severe is CVE-2026-62902?
Medium severity, with a CVSS score of 6.5, published 11 August 2026.
Which products and versions are affected?
Microsoft Windows Presentation Foundation .NET 10: >= 10.0.0, <= 10.0.10; .NET 9: >= 9.0.0, <= 9.0.18; .NET 8: >= 8.0.0, <= 8.0.29; Microsoft.WindowsDesktop.App.Runtime.win-arm64 (NuGet) ECOSYSTEM:introduced=10.0.0,fixed=10.0.11; Microsoft.WindowsDesktop.App.Runtime.win-x64 (NuGet) ECOSYSTEM:introduced=10.0.0,fixed=10.0.11; Microsoft.WindowsDesktop.App.Runtime.win-x86 (NuGet) ECOSYSTEM:introduced=10.0.0,fixed=10.0.11.
Is there a fix for CVE-2026-62902?
Yes. Microsoft.WindowsDesktop.App.Runtime.win-arm64 (NuGet): upgrade to 10.0.11 or later; Microsoft.WindowsDesktop.App.Runtime.win-x64 (NuGet): upgrade to 10.0.11 or later; Microsoft.WindowsDesktop.App.Runtime.win-x86 (NuGet): upgrade to 10.0.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-62902 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-62902?
Check whether you run Microsoft Visual Studio 2022, Microsoft Visual Studio 2026, Microsoft Windows or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Microsoft.WindowsDesktop.App.Runtime.win-arm64 (NuGet): upgrade to 10.0.11 or later
    dotnet add package Microsoft.WindowsDesktop.App.Runtime.win-arm64 --version 10.0.11
  • Microsoft.WindowsDesktop.App.Runtime.win-x64 (NuGet): upgrade to 10.0.11 or later
    dotnet add package Microsoft.WindowsDesktop.App.Runtime.win-x64 --version 10.0.11
  • Microsoft.WindowsDesktop.App.Runtime.win-x86 (NuGet): upgrade to 10.0.11 or later
    dotnet add package Microsoft.WindowsDesktop.App.Runtime.win-x86 --version 10.0.11

Technical details

An information disclosure vulnerability exists in Windows Presentation Foundation (WPF) due to improper handling of untrusted functionality during document parsing. The flaw is categorized under CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) and CWE-918 (Server-Side Request Forgery). An unauthenticated remote attacker can exploit this by inducing a user to open a specially crafted document, triggering the inclusion of external functionality that allows the attacker to disclose information over the network. The vulnerability affects .NET 8, 9, and 10. Patches are available in .NET versions 8.0.30, 9.0.19, and 10.0.11.

Affected products

  • Microsoft Windows Presentation Foundation (WPF) .NET 10: >= 10.0.0, <= 10.0.10; .NET 9: >= 9.0.0, <= 9.0.18; .NET 8: >= 8.0.0, <= 8.0.29

Identifiers

  • CVE-2026-62902
  • GHSA-9mrh-pw7c-9mqm

Timeline

  • 2026-08-11: disclosed
  • 2026-08-11: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.