.NET WPF Patch Fixes High-Severity RCE Flaw in Framework 8-11 Preview Requiring User Interaction

An attacker who successfully exploits this vulnerability gains the ability to execute arbitrary code on a victim’s Windows system. According to Microsoft’s security advisory, the threat actor needs only to convince a user to interact with a crafted link or document. This interaction triggers the deserialization of untrusted data within the .NET Framework, leading to remote code execution. The vulnerability is rated high severity with a CVSS score of 8.8, reflecting the significant impact on confidentiality, integrity, and availability once the user engages with the malicious content.

How it unfolded

• Microsoft released a security advisory detailing CVE-2026-70035 in the .NET Framework WPF component.
• The advisory identified deserialization of untrusted data as the root cause of the remote code execution risk.
• Microsoft published patched versions of the Microsoft.WindowsDesktop.App.Runtime packages for Windows platforms.

Who is affected

The vulnerability impacts Microsoft .NET projects running on Windows across all architectures. It specifically affects applications using Microsoft.WindowsDesktop.App.Runtime packages. According to the GitHub advisory, versions 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, and 10.0.0 through 10.0.12 are vulnerable. Preview and release candidate versions of .NET 11, from 11.0.0-preview.1 to 11.0.0-rc.1, are also affected. This aligns with earlier reporting by RedTeam Tribune on October 14, which highlighted similar deserialization risks in .NET WPF components.

The fix

Microsoft has provided updated runtime packages to address the flaw. For .NET 8, the patched version is 8.0.32. For .NET 9, the fix is available in version 9.0.21. Applications using .NET 10 should update to version 10.0.13. Those testing .NET 11 preview builds must upgrade to 11.0.0-rc.2. The patches introduce restrictive XAML and XPS security fixes, including blocks on unsafe URI fetching, propagation of untrusted-input states through hyperlink navigation, TrueType font protection, and XAML nesting-depth limits.

What made it possible

Deserialization vulnerabilities typically arise when applications process untrusted data without sufficient validation. Attackers exploit this by crafting malicious input that forces the application to instantiate unexpected objects. This technique often serves as an initial access vector or privilege escalation method. Managed service providers should ensure their clients’ applications validate all incoming data structures. Teams usually implement strict type checking and avoid deserializing data from untrusted sources. Monitoring for unusual object instantiation patterns can help detect exploitation attempts early.

What to do and how to stay safe: Microsoft

• Update all .NET Framework applications to the latest patched runtime versions immediately.
• Audit client environments for applications using vulnerable package versions listed in the advisory.
• Monitor network traffic for unusual outbound connections following user interactions with external links.
• Educate users to avoid clicking on suspicious links or opening untrusted documents.

Step-by-step guide: What Is Virtual Patching: How It Works Without Code Changes

General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does this vulnerability require user interaction?

Yes, the CVSS vector indicates user interaction is required for exploitation.

Which .NET versions are affected by CVE-2026-70035?

Versions 8, 9, 10, and preview releases of 11 are affected.

Is there a patch available for this flaw?

Yes, Microsoft has released patched versions for all affected .NET runtimes.