.NET WPF Deserialization Flaw Enables Remote Code Execution on Windows Systems
A high-severity deserialization flaw in .NET WPF lets attackers run code on Windows systems if a user interacts with a crafted link.
Key points
- Microsoft rates CVE-2026-87697 as high severity with a CVSS score of 8.8.
- The flaw affects .NET versions 8, 9, 10, and 11 preview releases on Windows.
- Patches are available for all affected runtime packages in the latest updates.
An attacker can execute arbitrary code on a Windows machine by tricking a user into clicking a malicious link within a .NET application. The vulnerability, tracked as CVE-2026-87697, resides in the Windows Presentation Foundation component. Microsoft classifies the issue as high severity, noting that it allows unauthorized code execution over a network. This threat model requires user interaction, distinguishing it from fully unauthenticated remote exploits.
How it unfolded
- Microsoft released a security advisory detailing the deserialization of untrusted data flaw in .NET.
- GitHub published advisory GHSA-c27m-942f-rcfh confirming the high severity and affected packages.
- The vendor assigned a CVSS 3.1 score of 8.8 to reflect the high impact potential.
Who is affected
Developers using Microsoft.WindowsDesktop.App.Runtime packages on Windows are exposed. The flaw impacts versions 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, and 10.0.0 through 10.0.12. Preview releases of version 11, specifically from 11.0.0-preview.1 to 11.0.0-rc.1, are also vulnerable. The issue spans all Windows architectures, including x86, x64, and ARM64 platforms.
The fix
Microsoft has released patched versions for all affected runtimes. Users on version 8 should update to 8.0.32. Those on version 9 must move to 9.0.21. Version 10 users need to install 10.0.13. For version 11 preview users, the fix is in 11.0.0-rc.2. These updates are available via NuGet and address the deserialization weakness in WPF XPS synthetic hyperlinks.
What made it possible
Teams usually encounter this class of flaw when applications process external data without strict validation. The weakness stems from deserializing untrusted input, which can reconstruct objects that bypass security controls. In this case, UI Automation features exposed synthetic hyperlinks that ignored navigation restrictions. This stage of an intrusion serves as an initial foothold, granting code execution after a user engages with the interface. Check whether your applications sanitize all incoming data streams.
What to do and how to stay safe: Microsoft
- Audit your NuGet dependencies for the specific vulnerable .NET runtime versions listed in the advisory.
- Apply the latest patches to your development environments and production servers immediately.
- Monitor application logs for unusual execution patterns or unexpected process spawns after user clicks.
- Review your UI Automation configurations to ensure navigation checks are enforced on all hyperlinks.
Step-by-step guide: What Is Virtual Patching: How It Works Without Code Changes
General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does this vulnerability require authentication to exploit?
No, the CVSS vector indicates no privileges are required, but user interaction is necessary for exploitation.
Which .NET versions are safe from this specific flaw?
Versions 8.0.32, 9.0.21, 10.0.13, and 11.0.0-rc.2 are patched and considered safe.
Is this related to the recent Adobe ColdFusion flaw?
No, this is a distinct issue in Microsoft .NET WPF, whereas the Adobe flaw involved ColdFusion code injection.
