Microsoft .NET: Remote Code Execution through deserialization of untrusted data
Summary
A deserialization flaw in the Microsoft .NET runtime (including the WPF desktop framework) and in Visual Studio 2022 and 2026 allows code execution on the affected system over the network. Microsoft's advisory describes WPF XPS synthetic hyperlinks as the vulnerable path, and an attacker needs a user to open a crafted XPS document and activate a link. Exploitation is rated less likely by Microsoft, and the vulnerability has not been publicly disclosed.
Affected
- Microsoft .NET 8.0: 8.0.0 to before 8.0.32
- Microsoft .NET 9.0: 9.0.0 to before 9.0.21
- Microsoft .NET 10.0: 10.0.0 to before 10.0.13
- Microsoft .NET 11.0 previews: 11.0.0 to before 11.0.0-rc.2
- Microsoft Visual Studio 2022 version 17.14: before 17.14.42
- Microsoft Visual Studio 2026 version 18.10: before 18.10.4
- .NET 6 (out of support): reported as affected by a third party, not assessed by Microsoft (unverified)
Fixed in
- .NET 8.0.32 Runtime or .NET 8.0.426 SDK
- .NET 9.0.21 Runtime or .NET 9.0.319 SDK
- .NET 10.0.13 Runtime or .NET 10.0.402 SDK
- .NET 11.0.0-rc.2
- Visual Studio 2022 17.14.42
- Visual Studio 2026 18.10.4
- Whether .NET Framework is affected is unconfirmed; the October 13, 2026 cumulative update KB5127694 lists this CVE.
Workaround
No non-patch workaround documented. Unknown.
Exploitation
- Publicly disclosed: No
- Exploited in the wild: No
- Microsoft exploitability assessment: Exploitation Less Likely
- CISA SSVC: exploitation none, automatable no
- Not listed in CISA KEV
- No public proof of concept found
- EPSS 0.00843 (low)
Our recommendation
- Update .NET 8, 9 and 10 runtimes and SDKs to the fixed versions listed above.
- Update Visual Studio 2022 and 2026 to the fixed builds; Visual Studio also updates installed .NET SDKs.
- Prioritise developer workstations and machines running WPF applications that open XPS files or email attachments.
- Identify any .NET 6 installations, which are out of support and not patched by Microsoft, and plan their migration or obtain an extended-support fix.
- Verify the affected versions and any .NET Framework applicability on the MSRC page before rollout.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Response Center: CVE-2026-87697 msrc.microsoft.com
- GitHub Advisory GHSA-c27m-942f-rcfh github.com
- Microsoft .NET announcement issue 471 github.com
- HeroDevs vulnerability directory: CVE-2026-87697 www.herodevs.com
- OpenCVE: CVE-2026-87697 app.opencve.io
- Vulners MEND:CVE-2026-87697 (EPSS) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:15.
Original description (NVD)
Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.