Executive brief
A security vulnerability exists in Windows Presentation Foundation (WPF), a framework used for building Windows desktop applications. An attacker could exploit this flaw to run unauthorized code on a user's computer, potentially leading to a full system compromise or data theft. This typically requires a user to perform a specific action, such as opening a malicious file or application.
Technical details
An out-of-bounds write vulnerability (CWE-787) exists in the Windows Presentation Foundation (WPF) component of .NET. The flaw is triggered when the application writes data outside the boundaries of the intended buffer, which can be leveraged by an attacker to achieve arbitrary code execution. Exploitation requires local access and user interaction, such as a user running a specially crafted application. The vulnerability affects .NET 8, 9, and 10 runtimes on Windows. Microsoft has released patches (versions 8.0.30, 9.0.19, and 10.0.11) to address this issue.
Affected products
- Microsoft .NET 10 >= 10.0.0, <= 10.0.10
- Microsoft .NET 9 >= 9.0.0, <= 9.0.18
- Microsoft .NET 8 >= 8.0.0, <= 8.0.29
- Microsoft Windows Presentation Foundation All versions using affected .NET runtimes
Timeline
- 2026-08-11: disclosed
- 2026-08-11: advisory
- 2026-08-11: patched