Microsoft .NET WPF Pixel-Shader Heap Corruption

Microsoft has disclosed a critical security vulnerability, CVE-2026-96224, affecting the Windows Presentation Foundation (WPF) component within the .NET runtime. The vulnerability exists within the CPSTrans::Initialize function, where crafted pixel-shader bytecode can induce a desynchronization between two parsing passes. This flaw results in heap out-of-bounds read or write operations, which can be leveraged by a remote attacker to achieve arbitrary code execution on systems running vulnerable .NET applications. The issue impacts multiple versions of the .NET runtime, including .NET 8.0, 9.0, 10.0, and early versions of 11.0. Organizations are advised to update their .NET SDKs and runtime environments immediately. Furthermore, developers must recompile and redeploy self-contained applications that bundle the affected WPF components to ensure full remediation.

Impact

Successful exploitation allows for remote code execution on the underlying host. The impact is significant for any .NET desktop application that processes untrusted visual content or pixel-shader files. Given the prevalence of .NET in enterprise desktop environments, the potential scope includes a broad range of internal and third-party tools. If exploited, an attacker could gain the same privileges as the user running the affected application, leading to data exfiltration, local persistence, or lateral movement within the environment.

Recommendation

• Update all .NET environments to the latest patched versions: 8.0.32, 9.0.21, 10.0.13, or 11.0.0-rc.2.
• Trigger updates via Visual Studio to ensure local developer SDKs are remediated.
• Identify all self-contained deployments using dotnet --info and recompile these applications with the updated runtime versions to mitigate the risk of embedded vulnerable libraries.
• Monitor for abnormal crashes in .NET-based applications, as memory corruption exploits often cause instability in the host process prior to successful payload execution.