.NET 8-11: WPF Pixel-Shader Bytecode Out-of-Bounds Write Patched in Preview and Stable Builds
Microsoft patches a high-severity flaw in .NET Framework and WPF runtimes that allows attackers to execute code via crafted pixel-shader bytecode on Windows systems.
Key points
- The vulnerability is an out-of-bounds write in the Windows Presentation Foundation runtime.
- Affected versions span .NET 8 through 11, including preview releases.
- Microsoft has released patched versions for all affected packages.
Microsoft has addressed a high-severity remote code execution vulnerability in its .NET Framework components, specifically within the Windows Presentation Foundation runtime. The flaw, tracked as CVE-2026-70007, stems from an out-of-bounds write condition that can be triggered by malicious input. This issue affects applications running on Windows across all supported architectures, exposing environments that rely on vulnerable versions of the Microsoft.WindowsDesktop.App.Runtime packages to potential compromise.
Root cause
The underlying technical issue lies in the `CPSTrans::Initialize` function within the WPF rendering pipeline. According to the GitHub advisory, an attacker can supply crafted pixel-shader bytecode that desynchronizes the two parsing passes used by the component. This desynchronization leads to heap out-of-bounds writes or reads, allowing an unauthorized user to execute arbitrary code over a network. The weakness is classified as CWE-787, indicating a failure to properly handle memory boundaries during data processing.
Attack path
An attacker would need to deliver a specially crafted file or input containing the malicious pixel-shader bytecode to a target system running an affected version of the .NET runtime. Because the CVSS vector indicates user interaction is required (`UI:R`), the victim must likely open or process the malicious content. Once the flawed parsing logic is triggered, the out-of-bounds write can lead to remote code execution, granting the attacker control over the affected application and potentially the underlying system.
Affected versions
The vulnerability impacts multiple versions of the Microsoft.WindowsDesktop.App.Runtime packages for Windows, including x86, x64, and ARM64 architectures. Affected versions include .NET 8.0.0 through 8.0.31, .NET 9.0.0 through 9.0.20, .NET 10.0.0 through 10.0.12, and preview releases of .NET 11.0.0 from preview.1 through rc.1. Microsoft has provided patched versions for all these ranges, such as 8.0.32, 9.0.21, 10.0.13, and 11.0.0-rc.2.
Mitigation
- Update all Microsoft.WindowsDesktop.App.Runtime packages to the latest patched versions listed in the advisory.
- Verify that no legacy or preview versions of .NET 8, 9, 10, or 11 are running in production environments.
- Monitor application logs for unexpected crashes or memory access violations associated with WPF rendering tasks.
- Restrict user access to untrusted files that may contain malicious bytecode or shader data.
Detection notes
Security teams should monitor for anomalous process behavior in applications utilizing WPF rendering engines. Look for unexpected memory access violations, heap corruption alerts, or crashes originating from the `CPSTrans` component. Network traffic analysis may reveal unusual data payloads sent to vulnerable applications. Check whether endpoint detection tools are flagging suspicious execution patterns following user interaction with untrusted files. Investigate any instances where a standard application exhibits signs of code injection or unauthorized process spawning.
What to do and how to stay safe: Microsoft
- Audit your inventory for applications using Microsoft.WindowsDesktop.App.Runtime and verify their version numbers.
- Apply the latest patches from Microsoft to all affected .NET 8, 9, 10, and 11 installations immediately.
- Educate users to avoid opening untrusted files that could contain malicious pixel-shader bytecode.
- Monitor system logs for signs of out-of-bounds memory access or unexpected code execution in WPF-based apps.
Step-by-step guide: Unpatched Software Myths: Why Common Beliefs Fail to Protect You
General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-70007?
The CVSS 3.1 score is 8.8, which is rated as high severity.
Which .NET versions are affected by this vulnerability?
Versions 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12, and 11.0.0 preview releases up to rc.1 are affected.
Is there a fix available for this issue?
Yes, Microsoft has released patched versions including 8.0.32, 9.0.21, 10.0.13, and 11.0.0-rc.2.
