wpf

CVE-2026-87697: CVE-2026-87697: Untrusted Deserialization in .NET PresentationCore Clipboard Handling CVE-2026-87697: Untrusted Deserialization in .NET PresentationCore Clipboard Handling > Vulnerability ID: CVE-2026-87697 > CVSS Score: 8.8 > Published: 2026-10-13 A remote code execution vulnerability exists in Microsoft .NET due to untrusted data deserialization within the PresentationCore component. The flaw stems from implicit auto-conversion flags during clipboard data retrieval operations. TL;DR Implicit type auto-conversion in WPF PresentationCore clipboard routines allowed untrusted data streams to be automatically deserialized, enabling arbitrary code execution upon accessing clipboard data. --- Technical Details - CWE ID: CWE-502 - Attack Vector: Network (AV:N) - Attack Complexity: Low (AC:L) - Privileges Required: None (PR:N) - User Interaction: Required (UI:R) - CVSS v3.1 Score: 8.8 (HIGH) - Exploit Status: None / Unproven - CISA KEV Status: Not Listed Affected Systems - Microsoft .NET 8.0 - Microsoft .NET 9.0 - Microsoft .NET 10.0 - Microsoft .NET 11.0 - Microsoft Visual Studio 2022 (v17.14) - Microsoft Visual Studio 2026 (v18.10) - .NET 8.0: >= 8.0.0, < 8.0.32 (Fixed in: 8.0.32) - .NET 9.0: >= 9.0.0, < 9.0.21 (Fixed in: 9.0.21) - .NET 10.0: >= 10.0.0, < 10.0.13 (Fixed in: 10.0.13) - .NET 11.0: >= 11.0.0, < 11.0.0-rc.2 (Fixed in: 11.0.0-rc.2) - Visual Studio 2022: >= 17.14.0, < 17.14.42 (Fixed in: 17.14.42) - Visual Studio 2026: >= 18.10.0, < 18.10.4 (Fixed in: 18.10.4) Code Analysis Commit: 0987b40 Fix clipboard auto-convert parameters to enforce autoConvert: false during typed data checks. Commit: 8dd1964 Servicing update patch for PresentationCore clipboard validation. Mitigation Strategies - Upgrade .NET SDK and runtime components to fixed servicing releases. - Explicitly set autoConvert: false when querying external IDataObject contents in WPF application code. - Restrict user execution privileges for applications interacting with untrusted clipboard inputs. Remediation Steps: 1. Identify all installed instances of .NET 8.0, 9.0, 10.0, 11.0, and Visual Studio build hosts. 2. Apply security update builds: .NET 8.0.32, .NET 9.0.21, .NET 10.0.13, or .NET 11.0.0-rc.2. 3. Update Visual Studio 2022 installations to 17.14.42 and Visual Studio 2026 to 18.10.4. 4. Recompile WPF applications against the updated target SDKs. References - Microsoft Vulnerability Advisory - CVE Record - dotnet/wpf Fix Commit --- Read the full report for CVE-2026-87697 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-70007: CVE-2026-70007: Out-of-Bounds Write Vulnerability in .NET Framework and WPF Subsystem CVE-2026-70007: Out-of-Bounds Write Vulnerability in .NET Framework and WPF Subsystem > Vulnerability ID: CVE-2026-70007 > CVSS Score: 8.8 > Published: 2026-10-13 An out-of-bounds write vulnerability in Microsoft .NET Framework, .NET runtime, and Visual Studio allows unauthenticated remote attackers to execute arbitrary code via crafted pixel-shader bytecode or auto-converted clipboard payloads. TL;DR A heap-based out-of-bounds write vulnerability (CWE-787) in the Windows Presentation Foundation (WPF) graphics subsystem (CPSTrans::Initialize) and Clipboard API routines allows remote code execution when a targeted application processes malicious graphics assets or clipboard data. --- Technical Details - CWE ID: CWE-787 (Out-of-bounds Write) - Attack Vector: Network (AV:N) - CVSS v3.1 Score: 8.8 (High) - EPSS Score: Pending Baseline - Impact: Remote Code Execution (C:H/I:H/A:H) - Exploit Status: Unweaponized / No Public PoC - CISA KEV Status: Not Listed Affected Systems - Microsoft .NET 8.0 - Microsoft .NET 9.0 - Microsoft .NET 10.0 - Microsoft .NET 11.0 - Microsoft .NET Framework 3.5 - Microsoft .NET Framework 4.6.2 / 4.7 / 4.7.1 / 4.7.2 - Microsoft .NET Framework 4.8 - Microsoft .NET Framework 4.8.1 - Microsoft Visual Studio 2022 - Microsoft Visual Studio 2026 - .NET 8.0: >= 8.0.0, < 8.0.32 (Fixed in: 8.0.32) - .NET 9.0: >= 9.0.0, < 9.0.21 (Fixed in: 9.0.21) - .NET 10.0: >= 10.0.0, < 10.0.13 (Fixed in: 10.0.13) - .NET 11.0: >= 11.0.0, < 11.0.0-rc.2 (Fixed in: 11.0.0-rc.2) - .NET Framework 4.8.1: < 4.8.9363.0 (Fixed in: 4.8.9363.0) - Visual Studio 2022: < 17.14.42 (Fixed in: 17.14.42) Code Analysis Commit: 0987b40 Fix Clipboard API auto-conversion issue in GetTypedDataIfAvailable Commit: 8319b24 Add TrueType Subsetting Table Length Safeguards in TtfDelta/modtable.cpp Mitigation Strategies - Apply official Microsoft security updates for affected .NET, .NET Framework, and Visual Studio products. - Enforce least-privilege user execution policies to limit the potential impact of code execution. - Monitor process trees for anomalous child process spawning from WPF hosting binaries like PresentationHost.exe. Remediation Steps: 1. Identify all systems running vulnerable versions of .NET runtime (8.0, 9.0, 10.0, 11.0), .NET Framework, or Visual Studio. 2. Deploy Microsoft Security Updates released on October 13, 2026 via Windows Update, WSUS, or enterprise deployment tools. 3. Verify that .NET 8.0 is updated to >= 8.0.32, .NET 9.0 to >= 9.0.21, .NET 10.0 to >= 10.0.13, and .NET 11.0 to >= 11.0.0-rc.2. 4. Ensure Visual Studio 2022 is updated to version 17.14.42 or higher. References - MSRC Vulnerability Advisory - Official CVE Record - MITRE ATT&CK Mapping Search - GitHub Patch Commit - Clipboard API AutoConvert - GitHub Patch Commit - TrueType Subsetting Safeguards --- Read the full report for CVE-2026-70007 on our website for more details including interactive diagrams and full exploit analysis.