Is CVE-2026-96224 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-96224 being exploited in the wild.

How severe is CVE-2026-96224?

High severity, with a CVSS score of 8.8, published 13 October 2026.

Which products and versions are affected?

Microsoft .NET WindowsDesktop.App.Runtime win-arm64 8.0.0–8.0.31, 9.0.0–9.0.20, 10.0.0–10.0.12, 11.0.0-preview.1–11.0.0-rc.1; Microsoft .NET WindowsDesktop.App.Runtime win-x64 8.0.0–8.0.31, 9.0.0–9.0.20, 10.0.0–10.0.12, 11.0.0-preview.1–11.0.0-rc.1; Microsoft .NET WindowsDesktop.App.Runtime win-x86 8.0.0–8.0.31, 9.0.0–9.0.20, 10.0.0–10.0.12, 11.0.0-preview.1–11.0.0-rc.1; Microsoft.WindowsDesktop.App.Runtime.win-arm64 (NuGet) >= 10.0.0, <= 10.0.12, ECOSYSTEM:introduced=10.0.0,fixed=10.0.13; and 2 more.

Is there a fix for CVE-2026-96224?

Yes. Microsoft.WindowsDesktop.App.Runtime.win-arm64 (NuGet): upgrade to 10.0.13 or later; Microsoft.WindowsDesktop.App.Runtime.win-x64 (NuGet): upgrade to 10.0.13 or later; Microsoft.WindowsDesktop.App.Runtime.win-x86 (NuGet): upgrade to 10.0.13 or later. Until then: Applications that are self-contained deployments targeting affected .NET versions must be recompiled and redeployed with updated runtimes to be fully patched. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-96224 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-96224?

Check whether you run Microsoft .NET WindowsDesktop.App.Runtime win-arm64, Microsoft .NET WindowsDesktop.App.Runtime win-x64, Microsoft .NET WindowsDesktop.App.Runtime win-x86 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-96224: Microsoft .NET WindowsDesktop.App.Runtime heap buffer overflow in WPF shader parsing

Q: Is there a fix for CVE-2026-96224?

Yes. Microsoft.WindowsDesktop.App.Runtime.win-arm64 (NuGet): upgrade to 10.0.13 or later; Microsoft.WindowsDesktop.App.Runtime.win-x64 (NuGet): upgrade to 10.0.13 or later; Microsoft.WindowsDesktop.App.Runtime.win-x86 (NuGet): upgrade to 10.0.13 or later. Until then: Applications that are self-contained deployments targeting affected .NET versions must be recompiled and redeployed with updated runtimes to be fully patched. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-96224 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-96224?

Check whether you run Microsoft .NET WindowsDesktop.App.Runtime win-arm64, Microsoft .NET WindowsDesktop.App.Runtime win-x64, Microsoft .NET WindowsDesktop.App.Runtime win-x86 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-96224 · Severity: high · CVSS 8.8 · Published 2026-10-13

Microsoft .NET's Windows Desktop runtime includes WPF (Windows Presentation Foundation), a framework for building Windows desktop applications. A flaw in how it parses pixel-shader bytecode can allow an attacker to write to or read from memory outside intended bounds, potentially enabling remote code execution when a user opens a malicious document or application.

Technologies: Microsoft.WindowsDesktop.App.Runtime.win-arm64 (NuGet), Microsoft.WindowsDesktop.App.Runtime.win-x64 (NuGet), Microsoft.WindowsDesktop.App.Runtime.win-x86 (NuGet). Vendors: Microsoft, NuGet.

Quick answers

Is CVE-2026-96224 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-96224 being exploited in the wild.
How severe is CVE-2026-96224?: High severity, with a CVSS score of 8.8, published 13 October 2026.
Which products and versions are affected?: Microsoft .NET WindowsDesktop.App.Runtime win-arm64 8.0.0–8.0.31, 9.0.0–9.0.20, 10.0.0–10.0.12, 11.0.0-preview.1–11.0.0-rc.1; Microsoft .NET WindowsDesktop.App.Runtime win-x64 8.0.0–8.0.31, 9.0.0–9.0.20, 10.0.0–10.0.12, 11.0.0-preview.1–11.0.0-rc.1; Microsoft .NET WindowsDesktop.App.Runtime win-x86 8.0.0–8.0.31, 9.0.0–9.0.20, 10.0.0–10.0.12, 11.0.0-preview.1–11.0.0-rc.1; Microsoft.WindowsDesktop.App.Runtime.win-arm64 (NuGet) >= 10.0.0, <= 10.0.12, ECOSYSTEM:introduced=10.0.0,fixed=10.0.13; and 2 more.
Is there a fix for CVE-2026-96224?: Yes. Microsoft.WindowsDesktop.App.Runtime.win-arm64 (NuGet): upgrade to 10.0.13 or later; Microsoft.WindowsDesktop.App.Runtime.win-x64 (NuGet): upgrade to 10.0.13 or later; Microsoft.WindowsDesktop.App.Runtime.win-x86 (NuGet): upgrade to 10.0.13 or later. Until then: Applications that are self-contained deployments targeting affected .NET versions must be recompiled and redeployed with updated runtimes to be fully patched. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-96224 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-96224?: Check whether you run Microsoft .NET WindowsDesktop.App.Runtime win-arm64, Microsoft .NET WindowsDesktop.App.Runtime win-x64, Microsoft .NET WindowsDesktop.App.Runtime win-x86 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Microsoft.WindowsDesktop.App.Runtime.win-arm64 (NuGet): upgrade to 10.0.13 or later

dotnet add package Microsoft.WindowsDesktop.App.Runtime.win-arm64 --version 10.0.13

Microsoft.WindowsDesktop.App.Runtime.win-x64 (NuGet): upgrade to 10.0.13 or later

dotnet add package Microsoft.WindowsDesktop.App.Runtime.win-x64 --version 10.0.13

Microsoft.WindowsDesktop.App.Runtime.win-x86 (NuGet): upgrade to 10.0.13 or later

dotnet add package Microsoft.WindowsDesktop.App.Runtime.win-x86 --version 10.0.13

Applications that are self-contained deployments targeting affected .NET versions must be recompiled and redeployed with updated runtimes to be fully patched.

Technical details

A desynchronization between two parsing passes in CPSTrans::Initialize when processing crafted WPF pixel-shader bytecode leads to an out-of-bounds heap write or read (CWE-787). The vulnerability requires user interaction (opening a document/application) and network connectivity to deliver the payload, affecting all affected .NET versions from 8.0.0 through 10.0.12, and 11.0.0-preview.1 through 11.0.0-rc.1. Remote code execution is achievable.

Affected products

Microsoft .NET WindowsDesktop.App.Runtime win-arm64 8.0.0–8.0.31, 9.0.0–9.0.20, 10.0.0–10.0.12, 11.0.0-preview.1–11.0.0-rc.1
Microsoft .NET WindowsDesktop.App.Runtime win-x64 8.0.0–8.0.31, 9.0.0–9.0.20, 10.0.0–10.0.12, 11.0.0-preview.1–11.0.0-rc.1
Microsoft .NET WindowsDesktop.App.Runtime win-x86 8.0.0–8.0.31, 9.0.0–9.0.20, 10.0.0–10.0.12, 11.0.0-preview.1–11.0.0-rc.1

Identifiers

CVE-2026-96224
GHSA-xq57-crx4-g373

Timeline

2026-10-13: advisory

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.