CVE-2026-96232: Microsoft .NET WindowsDesktop App Runtime information disclosure

CVE-2026-96232 · Severity: high · CVSS 7.5 · Published 2026-10-13

Microsoft's .NET WindowsDesktop App Runtime, used to build Windows desktop applications with WPF, contains an out-of-bounds read vulnerability that allows unauthenticated remote attackers to disclose sensitive information. Affected applications could leak confidential data when processing untrusted input through XAML, XPS, hyperlink navigation, or DNS lookups.

Technologies: Microsoft WindowsDesktop.App.Runtime.win-arm64, Microsoft WindowsDesktop.App.Runtime.win-x64, Microsoft WindowsDesktop.App.Runtime.win-x86, Microsoft.WindowsDesktop.App.Runtime.win-arm64 (NuGet), Microsoft.WindowsDesktop.App.Runtime.win-x64 (NuGet), Microsoft.WindowsDesktop.App.Runtime.win-x86 (NuGet). Vendors: Microsoft, NuGet.

Quick answers

Is CVE-2026-96232 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-96232 being exploited in the wild.
How severe is CVE-2026-96232?
High severity, with a CVSS score of 7.5, published 13 October 2026.
Which products and versions are affected?
Microsoft WindowsDesktop.App.Runtime.win-arm64 11.0.0-preview.1 to 11.0.0-rc.1; 9.0.0 to 9.0.20; 8.0.0 to 8.0.31; 10.0.0 to 10.0.12; Microsoft WindowsDesktop.App.Runtime.win-x64 11.0.0-preview.1 to 11.0.0-rc.1; 9.0.0 to 9.0.20; 8.0.0 to 8.0.31; 10.0.0 to 10.0.12; Microsoft WindowsDesktop.App.Runtime.win-x86 11.0.0-preview.1 to 11.0.0-rc.1; 9.0.0 to 9.0.20; 8.0.0 to 8.0.31; 10.0.0 to 10.0.12; Microsoft.WindowsDesktop.App.Runtime.win-arm64 (NuGet) >= 11.0.0-preview.1, <= 11.0.0-rc.1, ECOSYSTEM:introduced=11.0.0-preview.1,fixed=11.0.0-rc.2; and 2 more.
Is there a fix for CVE-2026-96232?
Yes. Microsoft.WindowsDesktop.App.Runtime.win-arm64 (NuGet): upgrade to 11.0.0-rc.2 or later; Microsoft.WindowsDesktop.App.Runtime.win-x64 (NuGet): upgrade to 11.0.0-rc.2 or later; Microsoft.WindowsDesktop.App.Runtime.win-x86 (NuGet): upgrade to 11.0.0-rc.2 or later. Until then: Update to the patched .NET runtime or SDK version. If you have deployed self-contained applications targeting the affected versions, recompile and redeploy them with the patched runtime. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-96232 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-96232?
Check whether you run Microsoft WindowsDesktop.App.Runtime.win-arm64, Microsoft WindowsDesktop.App.Runtime.win-x64, Microsoft WindowsDesktop.App.Runtime.win-x86 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Microsoft.WindowsDesktop.App.Runtime.win-arm64 (NuGet): upgrade to 11.0.0-rc.2 or later
    dotnet add package Microsoft.WindowsDesktop.App.Runtime.win-arm64 --version 11.0.0-rc.2
  • Microsoft.WindowsDesktop.App.Runtime.win-x64 (NuGet): upgrade to 11.0.0-rc.2 or later
    dotnet add package Microsoft.WindowsDesktop.App.Runtime.win-x64 --version 11.0.0-rc.2
  • Microsoft.WindowsDesktop.App.Runtime.win-x86 (NuGet): upgrade to 11.0.0-rc.2 or later
    dotnet add package Microsoft.WindowsDesktop.App.Runtime.win-x86 --version 11.0.0-rc.2

Update to the patched .NET runtime or SDK version. If you have deployed self-contained applications targeting the affected versions, recompile and redeploy them with the patched runtime.

Technical details

An out-of-bounds read vulnerability (CWE-125) exists in Microsoft.WindowsDesktop.App.Runtime affecting WPF applications. The vulnerability can be triggered remotely without authentication or user interaction, allowing information disclosure. Fixes include restrictive XAML and XPS security checks, URI fetching controls, untrusted-input state propagation in hyperlinks, TrueType font protection, XAML nesting-depth limits, and DNS zone-policy caching restrictions.

Affected products

  • Microsoft WindowsDesktop.App.Runtime.win-arm64 11.0.0-preview.1 to 11.0.0-rc.1; 9.0.0 to 9.0.20; 8.0.0 to 8.0.31; 10.0.0 to 10.0.12
  • Microsoft WindowsDesktop.App.Runtime.win-x64 11.0.0-preview.1 to 11.0.0-rc.1; 9.0.0 to 9.0.20; 8.0.0 to 8.0.31; 10.0.0 to 10.0.12
  • Microsoft WindowsDesktop.App.Runtime.win-x86 11.0.0-preview.1 to 11.0.0-rc.1; 9.0.0 to 9.0.20; 8.0.0 to 8.0.31; 10.0.0 to 10.0.12

Identifiers

  • CVE-2026-96232
  • GHSA-f8qh-mqg4-9939

Timeline

  • 2026-10-13: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.