{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/microsoft.windowsdesktop.app.runtime-8.0.0-8.0.31-9.0.0-9.0.20-10.0.0-10.0.12-11.0.0-preview.1-11.0.0-rc.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:microsoft:dotnet:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-96224"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Microsoft.WindowsDesktop.App.Runtime (8.0.0-8.0.31, 9.0.0-9.0.20, 10.0.0-10.0.12, 11.0.0-preview.1-11.0.0-rc.1)",".NET"],"_cs_severities":["high"],"_cs_tags":[".net","windows","rce","heap-overflow","wp-vulnerability"],"_cs_type":"advisory","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eMicrosoft has disclosed a critical security vulnerability, CVE-2026-96224, affecting the Windows Presentation Foundation (WPF) component within the .NET runtime. The vulnerability exists within the \u003ccode\u003eCPSTrans::Initialize\u003c/code\u003e function, where crafted pixel-shader bytecode can induce a desynchronization between two parsing passes. This flaw results in heap out-of-bounds read or write operations, which can be leveraged by a remote attacker to achieve arbitrary code execution on systems running vulnerable .NET applications. The issue impacts multiple versions of the .NET runtime, including .NET 8.0, 9.0, 10.0, and early versions of 11.0. Organizations are advised to update their .NET SDKs and runtime environments immediately. Furthermore, developers must recompile and redeploy self-contained applications that bundle the affected WPF components to ensure full remediation.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for remote code execution on the underlying host. The impact is significant for any .NET desktop application that processes untrusted visual content or pixel-shader files. Given the prevalence of .NET in enterprise desktop environments, the potential scope includes a broad range of internal and third-party tools. If exploited, an attacker could gain the same privileges as the user running the affected application, leading to data exfiltration, local persistence, or lateral movement within the environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate all .NET environments to the latest patched versions: 8.0.32, 9.0.21, 10.0.13, or 11.0.0-rc.2.\u003c/li\u003e\n\u003cli\u003eTrigger updates via Visual Studio to ensure local developer SDKs are remediated.\u003c/li\u003e\n\u003cli\u003eIdentify all self-contained deployments using \u003ccode\u003edotnet --info\u003c/code\u003e and recompile these applications with the updated runtime versions to mitigate the risk of embedded vulnerable libraries.\u003c/li\u003e\n\u003cli\u003eMonitor for abnormal crashes in .NET-based applications, as memory corruption exploits often cause instability in the host process prior to successful payload execution.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T01:48:51Z","date_published":"2026-10-14T00:31:06Z","id":"https://feed.craftedsignal.io/briefs/2026-10-net-wpf-rce/","summary":"A heap out-of-bounds vulnerability in the .NET WPF runtime allows attackers to achieve remote code execution through crafted pixel-shader bytecode.","title":"Microsoft .NET WPF Pixel-Shader Heap Corruption","url":"https://feed.craftedsignal.io/briefs/2026-10-net-wpf-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Microsoft.WindowsDesktop.App.Runtime (8.0.0-8.0.31, 9.0.0-9.0.20, 10.0.0-10.0.12, 11.0.0-Preview.1-11.0.0-Rc.1)","version":"https://jsonfeed.org/version/1.1"}