Windows enterprises urged to patch .NET Desktop Runtime to block remote privilege escalation via CVE-2026-85363

Microsoft has released a security advisory for CVE-2026-85363, a high-severity vulnerability in the .NET Framework. The flaw exists in the Windows Desktop Runtime component and affects organizations running applications built with specific NuGet packages. This issue touches small businesses and enterprises that deploy Windows-based software using these common development libraries.

The risk

The vulnerability stems from an integer overflow or wraparound error within the .NET Framework. According to the official Microsoft Security Update Guide, this defect allows an unauthorized attacker to elevate privileges over a network. The GitHub advisory details that attacker-controlled XPS glyph coordinates can overflow destination pointer arithmetic. This leads to an out-of-bounds write and potential process termination.

Who is exposed

The flaw impacts Microsoft.WindowsDesktop.App.Runtime packages across multiple architectures. Affected versions include .NET 8.0.0 through 8.0.31, .NET 9.0.0 through 9.0.20, and .NET 10.0.0 through 10.0.12. Preview versions of .NET 11 are also vulnerable. The issue applies to Windows systems running arm64, x64, and x86 architectures.

Cost and compliance

The Common Vulnerability Scoring System 3.1 rates this vulnerability as high severity with a score of 8.8. The CVSS vector indicates network-based attack vectors with low complexity. The attack requires user interaction, as specified by the UI:R metric. The weakness is classified as CWE-190, integer overflow or wraparound.

What happens next

Organizations should verify their current .NET runtime versions immediately. If you are running any of the affected versions listed in the advisory, you must update to the patched releases. Microsoft has provided specific version numbers that resolve the issue for each supported branch.

Questions to ask your suppliers

Teams usually need to confirm whether third-party applications rely on vulnerable .NET components. Check whether your vendors have tested their software against the patched runtime versions. Determine who inside the organization is responsible for validating these updates before deployment. Ask if the supplier has a timeline for releasing compatible updates if they bundle their own runtime. Ensure your procurement team knows about this risk for future contracts.

What to do and how to stay safe: Microsoft

• Audit your inventory for applications using the affected Microsoft.WindowsDesktop.App.Runtime packages.
• Update to the patched versions: 8.0.32, 9.0.21, 10.0.13, or 11.0.0-rc.2.
• Monitor network traffic for unusual privilege escalation attempts during the transition.
• Verify that all Windows architectures (arm64, x64, x86) are updated consistently.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Breaks Your Business

General security guidance from the CloudSec Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-85363?

It is a high-severity elevation of privilege vulnerability in the .NET Framework caused by an integer overflow.

Which .NET versions are affected?

Versions 8.0.0 to 8.0.31, 9.0.0 to 9.0.20, 10.0.0 to 10.0.12, and 11.0.0-preview.1 to 11.0.0-rc.1 are vulnerable.

Is a patch available?

Yes, Microsoft has released patched versions including 8.0.32, 9.0.21, 10.0.13, and 11.0.0-rc.2.