Microsoft .NET: Elevation of privilege via integer overflow

Summary

An integer overflow (CWE-190) in the Microsoft .NET runtime and .NET Framework allows an attacker to elevate privileges. Microsoft describes the trigger as attacker-controlled XPS glyph coordinates that cause an out-of-bounds write in WPF rendering, so user interaction is required, for example by opening or displaying a crafted document in a WPF application. The official CVE record and the advisory sources conflict on the attack vector and impact, so the network-vector wording is unconfirmed until NVD analysis is complete.

Affected

• Microsoft .NET 8.0 runtime: 8.0.0 to before 8.0.32
• Microsoft .NET 9.0 runtime: 9.0.0 to before 9.0.21 (per CVE record; sources differ)
• Microsoft .NET 10.0 runtime: 10.0.0 to before 10.0.13 (per CVE record; sources differ)
• Microsoft .NET 11.0 runtime: 11.0.0 to before 11.0.0-rc.2 (per CVE record; sources differ)
• .NET Framework 4.8 and 4.8.1 and 3.5 builds listed in the Microsoft advisory (exact build list unconfirmed)
• Visual Studio 2026 version 18.10: 18.10.0 to before 18.10.4
• Visual Studio 2022 version 17.14: 17.14.0 to before 17.14.42
• .NET 6: not assessed by Microsoft; a third-party fix exists only

Fixed in

• .NET 8.0: 8.0.32
• Visual Studio 2026 18.10: 18.10.4
• .NET 9.0 and .NET 10.0: Unknown. Check the Microsoft advisory.
• .NET Framework: October 13, 2026 cumulative update (KB5127694)
• .NET 6: No Microsoft fix. Third-party extended support build NES for .NET 6.0.47 (HeroDevs), not a Microsoft release.

Workaround

• Unknown. No vendor workaround found.
• General hardening, not vendor-documented: avoid opening untrusted XPS documents in WPF applications until patched.

Exploitation

• In the wild: No evidence found. Not listed in CISA KEV according to one tracker; verify directly.
• Public proof of concept: None found, which is not proof of absence.
• CISA SSVC: Exploitation none, automatable no, technical impact total.

Our recommendation

• Patch .NET 8, Visual Studio 2026 to 18.10.4, and install the October 2026 .NET Framework cumulative update.
• Confirm the affected build list and the .NET 9 and .NET 10 fixed versions in the Microsoft advisory.
• Inventory WPF applications and Visual Studio installations; prioritise desktop software that opens external documents.
• Replace or extend .NET 6 WPF applications, as they have no Microsoft fix.
• Re-check NVD and CISA KEV once NVD analysis is complete.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide CVE-2026-85363 msrc.microsoft.com
• GitHub dotnet announcements issue 469 github.com
• GitHub Advisory GHSA-f63g-mx39-3r38 github.com
• Microsoft KB5127694 (October 13, 2026) support.microsoft.com
• Visual Studio 2026 release notes learn.microsoft.com
• HeroDevs vulnerability directory www.herodevs.com
• Ubuntu security CVE-2026-85363 ubuntu.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:22.