Microsoft released patches for a high-severity out-of-bounds write flaw in .NET WPF that lets attackers run code over a network.
Key points
- CVE-2026-96235 allows unauthorized remote code execution via crafted pixel-shader bytecode.
- Affected versions include .NET 8, 9, 10, and 11 preview runtimes up to specific patch levels.
- Microsoft provides patched versions 8.0.32, 9.0.21, 10.0.13, and 11.0.0-rc.2.
Microsoft has released security updates for a high-severity vulnerability in its .NET framework. The flaw, identified as CVE-2026-96235, enables attackers to execute arbitrary code remotely by exploiting weaknesses in Windows Presentation Foundation components.
What happened
Microsoft disclosed CVE-2026-96235 as a remote code execution vulnerability in .NET WPF runtimes. According to the official advisory, an out-of-bounds write occurs when processing crafted pixel-shader bytecode. This issue affects multiple versions of the Microsoft.WindowsDesktop.App.Runtime packages across Windows platforms. The flaw allows unauthorized attackers to run code over a network without needing local credentials.
The GitHub advisory lists affected versions including .NET 8 up to 8.0.31, .NET 9 up to 9.0.20, .NET 10 up to 10.0.12, and .NET 11 previews up to 11.0.0-rc.1. The Common Vulnerability Scoring System rates this flaw at 8.8, which is classified as high severity. The vector indicates network accessibility and low complexity for exploitation.
Why it matters
Out-of-bounds writes happen when a program writes data beyond the allocated memory space. Attackers can use this to overwrite critical memory structures or inject malicious code. In this case, the WPF engine fails to properly validate shader bytecode during parsing. This desynchronization allows the attacker to control where data is written in memory. That suggests any application using these older WPF components is potentially vulnerable to remote compromise.
The fix
- Update .NET 8 runtimes to version 8.0.32.
- Update .NET 9 runtimes to version 9.0.21.
- Update .NET 10 runtimes to version 10.0.13.
- Update .NET 11 preview runtimes to version 11.0.0-rc.2.
Why it matters
Teams usually prioritize patching remote code execution flaws because they allow attackers to take full control of a system. Check whether your applications depend on older .NET runtime versions. Verify that deployment pipelines automatically pull the latest secure package versions. Monitor network logs for unusual traffic patterns that might indicate exploitation attempts. Ensure developers test updates in staging environments before pushing to production servers.
What to do and how to stay safe: Microsoft
- Audit your applications to identify which .NET WPF runtime versions are currently in use.
- Apply the specific patched versions listed in Microsoft's advisory as soon as possible.
- Review network logs for suspicious outbound connections from systems running vulnerable software.
- Educate development teams about the risks of using outdated dependencies in new projects.
Step-by-step guide: Patch Testing: How to Verify Fixes Without Breaking Your Systems
General security guidance from the Crypt Weekly newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-96235?
It is a high-severity out-of-bounds write vulnerability in Microsoft .NET WPF that allows remote code execution.
Which .NET versions are affected?
Versions 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12, and 11.0.0-preview.1 through 11.0.0-rc.1.
Is there a fix available?
Yes, Microsoft has released patched versions 8.0.32, 9.0.21, 10.0.13, and 11.0.0-rc.2.
