.NET Framework Deserialization Flaw CVE-2026-70035 in WPF Components
Microsoft releases patches for a high-severity remote code execution vulnerability in .NET Framework WPF components involving untrusted data deserialization.
Key points
- The vulnerability affects .NET Framework versions 8 through 11, including preview releases.
- Microsoft has released patched versions for all affected Windows Desktop App Runtime packages.
- The flaw is rated high severity with a CVSS score of 8.8 and allows remote code execution.
Microsoft has addressed a high-severity remote code execution vulnerability in its .NET Framework. The flaw, tracked as CVE-2026-70035, stems from the deserialization of untrusted data within Windows Presentation Foundation components.
What happened
An unauthorised attacker could execute code over a network by exploiting this deserialization issue. The vulnerability exists in Microsoft.WindowsDesktop.App.Runtime packages across multiple architectures. It affects .NET versions 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, and 10.0.0 through 10.0.12. Preview builds of version 11 are also vulnerable.
Microsoft has released updates that resolve the issue. Patched versions include 8.0.32, 9.0.21, 10.0.13, and 11.0.0-rc.2. The fixes apply to win-x86, win-x64, and win-arm64 runtimes. This follows recent critical patches for RPC and Failover Cluster drivers, as Packet Tribune reported on 14 October 2026.
Why it matters
The flaw allows remote code execution via deserialization of untrusted data. Microsoft classifies the severity as high with a CVSS score of 8.8. The attack vector is network-based. The CVSS vector includes UI:R, indicating user interaction is required for exploitation.
The security fixes also address restrictive XAML and XPS issues. Updates block unsafe URI fetching and navigation. They propagate untrusted-input states through hyperlinks. Additional protections include TrueType font safeguards and XAML nesting-depth limits. These changes reduce the attack surface for desktop applications.
Next steps
- Identify all systems running affected .NET Framework versions.
- Verify current package versions against the vulnerable ranges.
- Deploy the patched runtimes to all relevant endpoints.
- Monitor for any unusual process spawning after updates.
Detection notes
Teams usually monitor for unexpected process creation from desktop applications. Check whether legitimate user actions correlate with new executable launches. Look for anomalous network connections initiated by WPF-hosted processes. Review logs for failed authentication attempts following user interaction with external documents. Contain affected hosts by isolating them from the network. Disable remote access capabilities temporarily. Preserve memory dumps for forensic analysis before rebooting.
What to do and how to stay safe: Microsoft
- Audit inventory for .NET Framework versions 8 through 11.
- Apply the latest Microsoft.WindowsDesktop.App.Runtime updates.
- Educate users on risks of opening untrusted documents.
- Review firewall rules to limit unnecessary outbound connections.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Production
General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which .NET versions are affected by CVE-2026-70035?
Versions 8.0.0 to 8.0.31, 9.0.0 to 9.0.20, 10.0.0 to 10.0.12, and 11.0.0-preview.1 to 11.0.0-rc.1 are vulnerable.
Is a patch available for this vulnerability?
Yes, Microsoft has released patched versions including 8.0.32, 9.0.21, 10.0.13, and 11.0.0-rc.2.
What is the severity rating of this flaw?
The vulnerability is rated high severity with a CVSS score of 8.8.
