Microsoft patches .NET 8-11 to fix high-severity WPF RCE flaw in preview builds

Microsoft has issued security updates for its .NET runtime to address a remote code execution vulnerability identified as CVE-2026-70007. The flaw affects the Windows Presentation Foundation component and allows unauthorized attackers to execute code over a network by exploiting an out-of-bounds write error.

What happened

Microsoft disclosed an out-of-bounds write vulnerability in the .NET runtime that enables remote code execution. According to the official security advisory, an attacker can exploit this flaw by sending crafted WPF pixel-shader bytecode. This malicious input desynchronizes the two parsing passes in the `CPSTrans::Initialize` method. The desynchronization leads to heap out-of-bounds writes or reads, which can result in arbitrary code execution.

The GitHub advisory rates the severity of CVE-2026-70007 as high, with a CVSS score of 8.8. The vulnerability affects all Windows architectures. Microsoft has provided patched versions for multiple .NET runtime packages. For .NET 9, versions up to 9.0.20 are vulnerable, and the fix is in version 9.0.21. For .NET 10, versions up to 10.0.12 are affected, with the patch available in version 10.0.13.

Microsoft also addressed the issue in .NET 8 and .NET 11 preview releases. For .NET 8, versions up to 8.0.31 are vulnerable, and the fix is in version 8.0.32. For .NET 11, preview versions up to 11.0.0-rc.1 are affected, with the patch in version 11.0.0-rc.2. The affected packages include Microsoft.WindowsDesktop.App.Runtime for win-arm64, win-x64, and win-x86 platforms.

Why it matters

This vulnerability allows for network-based code execution without requiring authentication, though user interaction is required according to the CVSS vector. That suggests that any system running affected .NET versions and processing untrusted WPF content is at risk. The flaw impacts a wide range of .NET versions, including stable releases and preview builds. Organizations relying on Windows Presentation Foundation for their applications must update their runtimes to mitigate the risk of remote exploitation.

What to watch

• Monitor Microsoft security advisories for additional details on exploitation techniques.
• Check internal inventory for applications using affected .NET runtime versions.
• Verify that deployment pipelines include the patched NuGet packages.
• Review network logs for unusual traffic patterns targeting WPF services.

Who needs to act first

Teams should prioritize updating systems that expose WPF applications to external networks. Check whether any public-facing services use affected .NET versions. Roll out patches to these exposed systems first to reduce the attack surface. Test the updates in a staging environment before full deployment to ensure application stability. Back up critical configurations and application data before applying the changes. If immediate patching is not possible, restrict network access to vulnerable services.

Background: CVSS score

The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.

Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes

What to do and how to stay safe: Microsoft

• Audit your environment to identify all instances of .NET runtime versions 8, 9, 10, and 11.
• Update NuGet packages to the patched versions listed in the Microsoft advisory.
• Restrict network access to systems running vulnerable .NET runtimes until patched.
• Monitor application logs for signs of exploitation attempts or unusual WPF activity.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which .NET versions are affected by CVE-2026-70007?

Versions 8.0.0 to 8.0.31, 9.0.0 to 9.0.20, 10.0.0 to 10.0.12, and 11.0.0-preview.1 to 11.0.0-rc.1 are affected.

What is the patched version for .NET 9?

The patched version for .NET 9 is 9.0.21 for all affected Windows desktop app runtime packages.

Does this vulnerability require user interaction?

Yes, the CVSS vector indicates that user interaction is required for exploitation.