Critical .NET WPF Flaw CVE-2026-96235 Threatens Apps With Network Code Execution

Microsoft has released a security advisory for CVE-2026-96235, a high-severity vulnerability in the .NET Windows Presentation Foundation runtime. The flaw allows an unauthorized attacker to execute code over a network by sending crafted WPF pixel-shader bytecode. This desynchronizes parsing passes, causing heap out-of-bounds writes or reads. Organizations running Windows-based applications using affected .NET versions face potential remote compromise.

The risk

The vulnerability carries a CVSS v3.1 score of 8.8, classified as high severity. The attack vector is network-based, requiring low complexity and no privileges. User interaction is required, but the impact on confidentiality, integrity, and availability is high. This issue stems from an out-of-bounds write weakness, identified as CWE-787. The GitHub advisory notes that crafted bytecode can desynchronize parsing passes in the initialization process.

Who is exposed

The flaw affects Microsoft.WindowsDesktop.App.Runtime packages on Windows across all architectures. Vulnerable versions include .NET 8.0.0 through 8.0.31, .NET 9.0.0 through 9.0.20, and .NET 10.0.0 through 10.0.12. Early preview and release candidate versions of .NET 11 are also affected. Small businesses relying on custom or third-party Windows desktop applications built with these frameworks are directly exposed to this network-based attack vector.

Cost and compliance

No direct financial costs or specific compliance penalties are detailed in the Microsoft advisory or GitHub advisory. The source material focuses solely on the technical nature of the vulnerability and the availability of patched software versions. Organizations should assess internal risk policies regarding high-severity remote code execution flaws, as failure to patch could lead to unauthorized system access and data compromise, though specific consequences are not enumerated in the reports.

What happens next

Managers should immediately audit their software inventory for applications using the affected .NET WPF runtime versions. Verify whether internal or vendor-supplied tools rely on these specific package ranges. Coordinate with development teams to test and deploy the patched versions provided by Microsoft. Prioritize systems exposed to untrusted network traffic, as the flaw allows remote exploitation.

Questions to ask your suppliers

Teams usually begin by asking vendors if their products depend on the affected .NET WPF runtime versions. Check whether any third-party applications running on your Windows infrastructure use these specific package ranges. Determine if the supplier has validated a patch or if they are waiting for Microsoft’s update. Inform your IT security lead and application owners about the potential exposure. Ensure that your incident response plan includes steps for rapid patching of high-severity remote code execution flaws.

What to do and how to stay safe: Microsoft

• Inventory all Windows applications to identify those using vulnerable .NET WPF runtime versions.
• Monitor vendor communications for confirmation of patches or workarounds for affected software.
• Restrict network access to systems running unpatched versions until updates can be applied.
• Review system logs for unusual activity that might indicate exploitation attempts.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Breaks Your Business

General security guidance from the CloudSec Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-96235?

The CVSS v3.1 score is 8.8, which is rated as high severity.

Which .NET versions are affected by this vulnerability?

Versions 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12, and early 11 previews are affected.

Is there a patch available for this flaw?

Yes, Microsoft has released patched versions for all affected .NET runtime packages.