Microsoft .NET: Remote code execution through deserialization of untrusted data

Summary

Deserialization of untrusted data in Microsoft .NET, including the WPF desktop runtime on Windows, allows an unauthorized attacker to execute code over a network. Exploitation requires that a user opens a crafted document, such as an XPS or fixed-format file, in a vulnerable application. Microsoft and NVD rate the issue CVSS 8.8, while CISA SSVC lists no exploitation and total technical impact.

Affected

• Microsoft .NET 8.0: 8.0.0 to before 8.0.32
• Microsoft .NET 9.0: 9.0.0 to before 9.0.21
• Microsoft .NET 10.0: 10.0.0 to before 10.0.13
• Microsoft .NET 11.0 previews: 11.0.0 to before 11.0.0-rc.2
• Microsoft .NET Framework versions listed in the MSRC advisory (including 3.5, 4.6.2 to 4.8.1)
• Microsoft Visual Studio 2022 version 17.14: before 17.14.42
• Microsoft Visual Studio 2026 version 18.10: before 18.10.4
• .NET 6: not assessed by Microsoft; a third-party vendor reports it as affected (unverified)

Fixed in

• .NET 8.0: 8.0.32
• .NET 9.0: 9.0.21
• .NET 10.0: 10.0.13
• .NET 11.0: 11.0.0-rc.2
• Visual Studio 2026 version 18.10: 18.10.4
• Visual Studio 2022 version 17.14: fixed build not confirmed
• .NET Framework: see MSRC advisory for the fixed builds per Windows version (e.g. Windows 11 26H2 cumulative update KB5127694)

Workaround

• No vendor-documented workaround. Apply the patches.
• Interim measure (not from a source): do not open untrusted XPS or fixed-format documents in WPF applications until patched.

Exploitation

• Public exploit: none known (VulDB reports no exploit available).
• Exploited in the wild: nothing known. CISA KEV listing not verified.
• EPSS 1.3% (OpenCVE).
• Credits: Dr.-Ing Ashar Javed and Vincent55 Yang.

Our recommendation

• Inventory systems with .NET 8, 9, 10 or 11 runtimes, .NET Framework, and Visual Studio 2022 17.14 or 2026 18.10.
• Install the October 2026 Windows and .NET updates and the fixed Visual Studio builds.
• Developers should update package references to the patched runtime versions.
• Until patched, avoid opening untrusted XPS or fixed-format documents, and filter phishing and downloaded files.
• Monitor for unusual process execution from document viewers.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83520 msrc.microsoft.com
• GitHub Advisory GHSA-4w5f-7jp2-w48g github.com
• Microsoft support: October 13, 2026 cumulative update (KB5127694) support.microsoft.com
• Visual Studio 2026 release notes learn.microsoft.com
• HeroDevs vulnerability directory: CVE-2026-83520 www.herodevs.com
• VulDB entry 418744 vuldb.com
• OpenCVE: CVE-2026-83520 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:38.