Remote Code Execution in Windows Presentation Foundation

Microsoft has disclosed a remote code execution vulnerability (CVE-2026-50646) affecting the Windows Presentation Foundation (WPF) framework within .NET 8, .NET 9, and .NET 10. The vulnerability stems from an improper protection mechanism (CWE-693) during the parsing of XAML input. An attacker capable of delivering specially crafted XAML data to a vulnerable application can achieve arbitrary code execution in the context of the current user. This vulnerability impacts all architectures on Windows. Developers are required to update to the patched runtime versions and recompile any self-contained applications to remediate the risk.

Impact

Successful exploitation allows an unauthenticated attacker to execute code as the user running the application, potentially leading to full system compromise or sensitive data exfiltration. The vulnerability affects a wide range of .NET desktop runtime versions, necessitating comprehensive patching across enterprise .NET environments.

Recommendation

• Update all .NET environments to the latest runtime versions: .NET 8.0.29, .NET 9.0.18, or .NET 10.0.10.
• For applications deployed as self-contained bundles, recompile and redeploy all instances using the patched runtime.
• Use the dotnet --info command across endpoints to inventory and identify instances of vulnerable .NET SDKs and runtimes.
• Audit applications that accept user-provided XAML input for potential exposure to untrusted data sources.