CVE-2026-96229: Microsoft .NET WindowsDesktop.App.Runtime information disclosure in XAML

CVE-2026-96229 · Severity: medium · CVSS 6.5 · Published 2026-10-13

A vulnerability in Microsoft's .NET Windows Desktop runtime allows applications to leak sensitive information through unsafe XAML processing and insecure hyperlink navigation. Attackers can exploit this by crafting malicious XAML or XPS documents that cause applications to fetch or navigate to unintended URIs, potentially exposing confidential data. Developers must update to patched versions of the WindowsDesktop.App.Runtime package to eliminate this risk.

Technologies: Microsoft WindowsDesktop.App.Runtime.win-arm64, Microsoft WindowsDesktop.App.Runtime.win-x64, Microsoft WindowsDesktop.App.Runtime.win-x86, Microsoft.WindowsDesktop.App.Runtime.win-arm64 (NuGet), Microsoft.WindowsDesktop.App.Runtime.win-x64 (NuGet), Microsoft.WindowsDesktop.App.Runtime.win-x86 (NuGet). Vendors: Microsoft, NuGet.

Quick answers

Is CVE-2026-96229 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-96229 being exploited in the wild.
How severe is CVE-2026-96229?
Medium severity, with a CVSS score of 6.5, published 13 October 2026.
Which products and versions are affected?
Microsoft WindowsDesktop.App.Runtime.win-arm64 8.0.0-8.0.31, 9.0.0-9.0.20, 10.0.0-10.0.12, 11.0.0-preview.1 to 11.0.0-rc.1; Microsoft WindowsDesktop.App.Runtime.win-x64 8.0.0-8.0.31, 9.0.0-9.0.20, 10.0.0-10.0.12, 11.0.0-preview.1 to 11.0.0-rc.1; Microsoft WindowsDesktop.App.Runtime.win-x86 8.0.0-8.0.31, 9.0.0-9.0.20, 10.0.0-10.0.12, 11.0.0-preview.1 to 11.0.0-rc.1; Microsoft.WindowsDesktop.App.Runtime.win-arm64 (NuGet) >= 9.0.0, <= 9.0.20, ECOSYSTEM:introduced=9.0.0,fixed=9.0.21; and 2 more.
Is there a fix for CVE-2026-96229?
Yes. Microsoft.WindowsDesktop.App.Runtime.win-arm64 (NuGet): upgrade to 9.0.21 or later; Microsoft.WindowsDesktop.App.Runtime.win-x64 (NuGet): upgrade to 9.0.21 or later; Microsoft.WindowsDesktop.App.Runtime.win-x86 (NuGet): upgrade to 9.0.21 or later. Until then: If unable to immediately update, restrict deployment of self-contained applications using affected .NET versions and avoid opening untrusted XAML or XPS files in applications built with vulnerable runtimes. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-96229 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-96229?
Check whether you run Microsoft WindowsDesktop.App.Runtime.win-arm64, Microsoft WindowsDesktop.App.Runtime.win-x64, Microsoft WindowsDesktop.App.Runtime.win-x86 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Microsoft.WindowsDesktop.App.Runtime.win-arm64 (NuGet): upgrade to 9.0.21 or later
    dotnet add package Microsoft.WindowsDesktop.App.Runtime.win-arm64 --version 9.0.21
  • Microsoft.WindowsDesktop.App.Runtime.win-x64 (NuGet): upgrade to 9.0.21 or later
    dotnet add package Microsoft.WindowsDesktop.App.Runtime.win-x64 --version 9.0.21
  • Microsoft.WindowsDesktop.App.Runtime.win-x86 (NuGet): upgrade to 9.0.21 or later
    dotnet add package Microsoft.WindowsDesktop.App.Runtime.win-x86 --version 9.0.21

If unable to immediately update, restrict deployment of self-contained applications using affected .NET versions and avoid opening untrusted XAML or XPS files in applications built with vulnerable runtimes.

Technical details

The vulnerability stems from CWE-183 (permissive list of allowed inputs) in XAML and XPS parsing within WPF's URI handling. The flaw allows unsafe URI fetching and navigation, propagation of untrusted input through hyperlinks, and improper TrueType font validation. An attacker with network access can trigger the vulnerability via a specially crafted XAML document through user interaction (UI:R), resulting in confidentiality disclosure without integrity or availability impact.

Affected products

  • Microsoft WindowsDesktop.App.Runtime.win-arm64 8.0.0-8.0.31, 9.0.0-9.0.20, 10.0.0-10.0.12, 11.0.0-preview.1 to 11.0.0-rc.1
  • Microsoft WindowsDesktop.App.Runtime.win-x64 8.0.0-8.0.31, 9.0.0-9.0.20, 10.0.0-10.0.12, 11.0.0-preview.1 to 11.0.0-rc.1
  • Microsoft WindowsDesktop.App.Runtime.win-x86 8.0.0-8.0.31, 9.0.0-9.0.20, 10.0.0-10.0.12, 11.0.0-preview.1 to 11.0.0-rc.1

Identifiers

  • CVE-2026-96229
  • GHSA-5qr9-xxm9-6cmq

Timeline

  • 2026-10-13: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.