DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-70354: CVE-2026-70354: Out-of-Bounds Write in .NET Windows Presentation Foundation Subsystem

#security #cve #cybersecurity

CVE-2026-70354: Out-of-Bounds Write in .NET Windows Presentation Foundation Subsystem

Vulnerability ID: CVE-2026-70354
CVSS Score: 7.8
Published: 2026-08-11

CVE-2026-70354 is a high-severity local code execution vulnerability affecting multiple versions of the Microsoft .NET runtime, .NET Framework, and Microsoft Visual Studio. The vulnerability is located within the Windows Presentation Foundation (WPF) layout and rendering subsystems, specifically within the parsing and rasterization of complex graphical layouts, XPS files, or custom font structures.

TL;DR

An out-of-bounds write vulnerability in Microsoft .NET WPF layout parsing allows local attackers to execute arbitrary code or escalate privileges by delivering malformed graphical elements or fonts to vulnerable desktop applications.

Technical Details

  • CWE ID: CWE-787
  • Attack Vector: Local (AV:L)
  • CVSS v3.1 Score: 7.8 (High)
  • Exploit Status: None
  • Impact: Arbitrary Code Execution / Local Privilege Escalation
  • Affected Subsystem: Windows Presentation Foundation (WPF) Rendering Subsystem

Affected Systems

  • .NET 10.0
  • .NET 9.0
  • .NET 8.0
  • .NET Framework 3.5
  • .NET Framework 4.6.2/4.7/4.7.1/4.7.2/4.8/4.8.1
  • Visual Studio 2022
  • Visual Studio 2026
  • .NET 10.0: >= 10.0.0, < 10.0.11 (Fixed in: 10.0.11)
  • .NET 9.0: >= 9.0.0, < 9.0.19 (Fixed in: 9.0.19)
  • .NET 8.0: >= 8.0.0, < 8.0.30 (Fixed in: 8.0.30)

Mitigation Strategies

  • Apply Microsoft security updates immediately.
  • Restrict untrusted XPS, XAML, and custom font files.
  • Enforce least privilege access controls across all desktop endpoints.

Remediation Steps:

  1. Identify all client and server systems running affected versions of .NET or .NET Framework.
  2. Deploy August 2026 security updates for Windows and .NET runtimes.
  3. Audit active desktop endpoints to verify that the version of wpfgfx_v0400.dll has been updated.
  4. Implement application control rules to prevent execution of unauthorized .NET desktop binaries.

References

Read the full report for CVE-2026-70354 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)