Microsoft .NET: Remote code execution in WPF runtime via crafted XPS document

Summary

Microsoft .NET contains a remote code execution flaw in the WPF runtime (Microsoft.WindowsDesktop.App.Runtime), which is Windows-only. Per Microsoft, WPF XPS hyperlink navigation can bypass URI restrictions and reach an attacker-controlled ObjectDataProvider. An attacker needs a user to open a crafted XPS document in a WPF application and follow a link, which can lead to code execution with the user's rights. The NVD description (network, no user interaction) differs from Microsoft's framing, so the Microsoft description is used here.

Affected

• .NET 8.0.0 to before 8.0.32 - .NET 9.0.0 to before 9.0.21 - .NET 10.0.0 to before 10.0.13 - .NET 11.0.0-preview.1 to before 11.0.0-rc.2 - .NET Framework 3.5, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 and 4.8.1 (affected builds per Microsoft's CVE record) - Visual Studio 2022 version 17.14 before 17.14.42 - Visual Studio 2026 version 18.10 before 18.10.4 - .NET 6 (end of life): not assessed by Microsoft; a third-party source reports it is affected

Fixed in

• .NET 8.0.32 - .NET 9.0.21 - .NET 10.0.13 - .NET 11.0.0-rc.2 - Visual Studio 2022 17.14.42 and Visual Studio 2026 18.10.4 - .NET Framework: October 13, 2026 security rollups (KB5127694 for Windows 11 26H2, KB5128927 for Windows Server 2012 R2); exact fixed build numbers not verified - .NET 6: no fix from Microsoft; only a paid extended support build is reported

Workaround

No vendor workaround known. Patching is the stated fix. Interim measure (not from the vendor): do not open XPS files or links from untrusted sources in WPF applications. Self-contained apps that bundle their own runtime must be rebuilt or redeployed, because OS patches do not update them.

Exploitation

• CISA SSVC: exploitation none, automatable no, technical impact total - Microsoft exploitability flag: not confirmed in the sources reviewed - Public proof of concept: none found in the searches performed - EPSS: 0.00913 (about 0.9%)

Our recommendation

• Patch .NET 8, 9 and 10 runtimes, .NET Framework and Visual Studio to the fixed versions above, prioritising workstations with WPF applications and Visual Studio - Identify self-contained or vendor WPF applications that bundle their own .NET runtime and request updates from the vendor or rebuild them - Replace or isolate .NET 6 installations, as no Microsoft fix is available - Restrict opening of XPS files and links from untrusted sources (email attachments, downloads) on workstations - Monitor for exploitation indicators and recheck exploit sources, as the proof-of-concept status may change

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-70174 msrc.microsoft.com
• Microsoft .NET advisory (dotnet/announcements) github.com
• GitLab advisory mirror (GHSA) for Microsoft.WindowsDesktop.App.Runtime advisories.gitlab.com
• HeroDevs vulnerability directory entry www.herodevs.com
• Visual Studio 2026 release notes learn.microsoft.com
• Microsoft .NET Framework update KB5127694 (Windows 11 26H2) support.microsoft.com
• Microsoft .NET Framework update KB5128927 (Windows Server 2012 R2) support.microsoft.com
• OpenCVE entry (CISA SSVC data) app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:54.