.NET WPF Out-of-Bounds Write in CVE-2026-70007 Allows Remote Code Execution
Microsoft patches high-severity heap corruption flaw in .NET WPF runtime that enables remote attackers to execute code via crafted pixel-shader bytecode.
Key points
- CVE-2026-70007 is a high-severity out-of-bounds write vulnerability in Microsoft .NET Framework WPF components.
- The flaw affects .NET 8, 9, 10, and preview builds of 11 across all Windows architectures.
- Microsoft has released patched versions for all affected runtime packages.
An attacker exploiting CVE-2026-70007 gains the ability to execute arbitrary code on a victim’s Windows system. According to Microsoft, this remote code execution capability is triggered when a user interacts with specially crafted WPF pixel-shader bytecode. The vulnerability resides in the Microsoft.WindowsDesktop.App.Runtime package and carries a high severity rating with a CVSS score of 8.8.
How it unfolded
- Microsoft identified a heap out-of-bounds write flaw in the WPF component of the .NET Framework.
- The issue stems from desynchronization in the `CPSTrans::Initialize` parsing passes when processing malicious bytecode.
- Microsoft released security advisories detailing the vulnerability and providing patched package versions.
Who is affected
Developers and users running vulnerable versions of the Microsoft.WindowsDesktop.App.Runtime on Windows systems are at risk. According to GitHub advisory GHSA-pfwj-2f93-rf42, the flaw impacts .NET 8 versions up to 8.0.31, .NET 9 versions up to 9.0.20, and .NET 10 versions up to 10.0.12. Preview and release candidate builds of .NET 11 are also affected. The vulnerability spans all supported Windows architectures, including x64, x86, and arm64.
The fix
Microsoft has provided patched versions for all affected packages. Users of .NET 8 should update to version 8.0.32. Those on .NET 9 must upgrade to 9.0.21, while .NET 10 users need version 10.0.13. For .NET 11 preview users, the fix is available in version 11.0.0-rc.2. These updates resolve the out-of-bounds write issue in the WPF runtime.
What made it possible
This vulnerability exploits a logic error in how the WPF engine parses pixel-shader bytecode. Attackers craft inputs that cause the parser’s two passes to fall out of sync, leading to memory corruption. This technique typically serves the initial access or exploitation phase of an intrusion. Managed service providers should monitor for similar parsing desynchronization flaws in graphics or rendering libraries. Teams usually validate input integrity before processing complex bytecode. Check whether your applications expose WPF surfaces to untrusted content. Ensure that runtime environments are kept current to mitigate memory safety risks.
What to do and how to stay safe: Microsoft
- Audit your inventory for applications using Microsoft.WindowsDesktop.App.Runtime versions prior to the patched releases.
- Verify that all .NET 8, 9, 10, and 11 preview environments are updated to the latest secure versions.
- Monitor network traffic for unusual outbound connections that may indicate post-exploitation activity.
- Review application logs for signs of unexpected WPF rendering errors or crashes following user interactions.
Step-by-step guide: What Is Virtual Patching: How It Works Without Code Changes
General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the severity of CVE-2026-70007?
The vulnerability is rated as high severity with a CVSS score of 8.8.
Which .NET versions are affected by this out-of-bounds write flaw?
.NET 8, 9, 10, and preview builds of .NET 11 are affected.
Is there a fix available for CVE-2026-70007?
Yes, Microsoft has released patched versions for all affected runtime packages.
