Microsoft .NET Framework: Remote code execution via out-of-bounds write

Summary

A out-of-bounds write flaw in the .NET runtime and .NET Framework, in the WPF (Windows Presentation Foundation) pixel-shader translation, allows an unauthenticated attacker to execute code. Exploitation requires that a user opens a specially crafted file or shader content, so the risk is client-side and user-triggered rather than an internet-facing service flaw. Microsoft rates the impact as total (confidentiality, integrity and availability), and CISA SSVC lists exploitation as none.

Affected

• .NET Framework 3.5, 4.6.2 to 4.8.1 (various builds, see Microsoft advisory)
• .NET 8.0 before 8.0.32
• .NET 9.0 before 9.0.21
• .NET 10.0 before 10.0.13
• .NET 11.0 before 11.0.0-rc.2
• Visual Studio 2022 version 17.14 (fixed build unconfirmed)
• Visual Studio 2026 version 18.10 before 18.10.4
• .NET 6: unknown, not assessed by Microsoft

Fixed in

• Security updates dated October 13, 2026 for .NET Framework (e.g. 4.8.1: 4.8.9363.0; 4.8: 4.8.4811.0; 4.6.2 to 4.7.2: 4.7.4150.0)
• .NET 9.0.21 and later; .NET 8.0.32 and later; .NET 10.0.13 and later (8.0 and 10.0 fixes not fully confirmed in Microsoft text)
• Visual Studio 2026 18.10.4 and later
• Visual Studio 2022 17.14: unknown
• .NET 6: unknown (third-party NES fix for 6.0.47 is not vendor-confirmed)

Workaround

• No vendor workaround found.
• Avoid opening untrusted files or shader content in WPF applications until patched.
• Rebuild and redeploy self-contained WPF applications after updating the runtime.

Exploitation

• No known exploitation; not listed in CISA KEV.
• Microsoft exploit maturity: Unproven (E:U).
• EPSS about 0.6%.
• No public proof of concept found.

Our recommendation

• Install the October 2026 .NET Framework, .NET and Windows security updates on all affected clients and servers, prioritising Windows clients with WPF applications and Visual Studio.
• Inventory .NET Framework, .NET runtime and Visual Studio versions, and check them against the MSRC advisory.
• Rebuild and redeploy self-contained WPF applications with the fixed runtime.
• Train users not to open unknown files from untrusted sources.
• Monitor for vulnerability scanner findings and vendor updates for .NET 6 and Visual Studio 2022.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-70007 msrc.microsoft.com
• Microsoft .NET GitHub advisory github.com
• Microsoft KB5127694 (Windows 11 26H2) support.microsoft.com
• Visual Studio 2026 release notes learn.microsoft.com
• OpenCVE: CVE-2026-70007 app.opencve.io
• Tenable plugin 366093 www.tenable.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 19:02.