Microsoft .NET: Out-of-bounds write leading to remote code execution

Summary

Microsoft .NET runtimes 8.0, 9.0, 10.0 and 11.0 previews, several .NET Framework versions, and Visual Studio 2022 17.14 and 2026 18.10 contain an out-of-bounds write in the WPF pixel-shader handling. An unauthenticated attacker can execute code over the network if a user opens or loads crafted content, such as a malicious file or link. Microsoft rates the vulnerability CVSS 8.8 (High), and no exploitation or public proof of concept is known.

Affected

• .NET 8.0: 8.0.0 to before 8.0.32
• .NET 9.0: 9.0.0 to before 9.0.21
• .NET 10.0: 10.0.0 to before 10.0.13
• .NET 11.0 previews: 11.0.0 to before 11.0.0-rc.2
• .NET Framework 3.5, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 and 4.8.1 (exact builds per MSRC)
• Visual Studio 2022 version 17.14: before 17.14.42
• Visual Studio 2026 version 18.10: before 18.10.4
• .NET 6.0 is end of life and not assessed by Microsoft

Fixed in

• .NET 8.0: 8.0.32
• .NET 9.0: 9.0.21
• .NET 10.0: 10.0.13
• .NET 11.0: 11.0.0-rc.2
• .NET Framework and Visual Studio: fixed builds unknown, check MSRC. Microsoft states that the .NET Framework update KB5127694 of October 13, 2026 addresses this CVE.
• .NET 6.0: third-party provider HeroDevs lists NES 6.0.47 (not a Microsoft fix)

Workaround

• No vendor workaround; apply the patches.
• The WPF switch Switch.MS.Internal.WpfGfx.DisableWpfGfxBoundsCheckProtection does not prevent this bug.
• Self-contained applications must be recompiled and redeployed, not only updated at system level.
• .NET 6.0 without extended support: no vendor-approved workaround known; upgrade or restrict untrusted content.

Exploitation

• No exploitation known.
• No public proof of concept known.
• CISA SSVC: exploitation none, automatable no, technical impact total.

Our recommendation

• Update .NET runtimes and WPF-based desktop applications to the fixed versions, and check MSRC for .NET Framework and Visual Studio builds.
• Recompile and redeploy self-contained applications.
• Prioritise workstations where users open untrusted files or links in WPF applications.
• Install the latest .NET patch level, as the October 25 out-of-band update fixed further flaws (CVE-2026-111497, CVE-2026-70197).
• Linux servers are not affected.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-96224 msrc.microsoft.com
• GitHub Advisory GHSA-xq57-crx4-g373 github.com
• .NET announcement issue 475 github.com
• Microsoft Support: .NET Framework update October 13, 2026 (KB5127694) support.microsoft.com
• HeroDevs vulnerability directory: CVE-2026-96224 www.herodevs.com
• Ubuntu security: CVE-2026-96224 ubuntu.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 17:55.