DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-62897: CVE-2026-62897: Integer Overflow and Code Execution in .NET WPF and WinForms

#security #cve #cybersecurity

CVE-2026-62897: Integer Overflow and Code Execution in .NET WPF and WinForms

Vulnerability ID: CVE-2026-62897
CVSS Score: 7.0
Published: 2026-08-11

An integer overflow vulnerability (CWE-190) exists in the layout and rendering engines of the Microsoft .NET Framework and .NET Core. This flaw resides within the processing of complex coordinate maps, font tables, and image metadata in Windows Presentation Foundation (WPF) and Windows Forms (WinForms). By convincing a user to open a crafted vector graphic or layout document, a local attacker can exploit this arithmetic error to induce an undersized memory allocation, leading to a heap-based buffer overflow and subsequent arbitrary code execution within the context of the vulnerable application.

TL;DR

An integer overflow in .NET's WPF and WinForms rendering components allows local attackers to execute arbitrary code via malformed layout or graphic data.

Technical Details

  • CWE ID: CWE-190 (Integer Overflow or Wraparound)
  • Attack Vector: Local (AV:L)
  • CVSS v3.1 Score: 7.0 (High)
  • Exploit Status: None (No public exploits or PoCs available)
  • KEV Status: Not listed in CISA Known Exploited Vulnerabilities catalog
  • Primary Impact: Local Arbitrary Code Execution

Affected Systems

  • Microsoft .NET 10.0
  • Microsoft .NET 9.0
  • Microsoft .NET 8.0
  • Microsoft .NET Framework 3.5
  • Microsoft .NET Framework 4.7.2
  • Microsoft .NET Framework 4.8
  • Microsoft .NET Framework 4.8.1
  • Microsoft Visual Studio 2022
  • Microsoft Visual Studio 2026
  • .NET: 10.0.0 to < 10.0.11 (Fixed in: 10.0.11)
  • .NET: 9.0.0 to < 9.0.19 (Fixed in: 9.0.19)
  • .NET: 8.0.0 to < 8.0.30 (Fixed in: 8.0.30)
  • Visual Studio 2022: 17.14.0 to < 17.14.38 (Fixed in: 17.14.38)
  • Visual Studio 2026: 18.0 to < 18.8.3 (Fixed in: 18.8.3)

Code Analysis

Commit: d147d62

Merge branch 'production' to update WPF dependencies and internal build references.

Mitigation Strategies

  • Apply Microsoft's official servicing security updates for .NET, .NET Framework, and Visual Studio
  • Validate dimensions and scale factors of user-supplied assets before processing them in drawing contexts
  • Use safe integer libraries or checked contexts in custom math logic to prevent arithmetic overflows

Remediation Steps:

  1. Identify all deployed versions of .NET, .NET Framework, and Visual Studio in the environment
  2. Apply Microsoft's August 2026 security updates to bring the components to the fixed versions
  3. For custom applications, wrap potentially unsafe coordinate math in checked blocks to catch overflows

References

Read the full report for CVE-2026-62897 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)