DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-87697: CVE-2026-87697: Untrusted Deserialization in .NET PresentationCore Clipboard Handling

#security #cve #cybersecurity

CVE-2026-87697: Untrusted Deserialization in .NET PresentationCore Clipboard Handling

Vulnerability ID: CVE-2026-87697
CVSS Score: 8.8
Published: 2026-10-13

A remote code execution vulnerability exists in Microsoft .NET due to untrusted data deserialization within the PresentationCore component. The flaw stems from implicit auto-conversion flags during clipboard data retrieval operations.

TL;DR

Implicit type auto-conversion in WPF PresentationCore clipboard routines allowed untrusted data streams to be automatically deserialized, enabling arbitrary code execution upon accessing clipboard data.

Technical Details

  • CWE ID: CWE-502
  • Attack Vector: Network (AV:N)
  • Attack Complexity: Low (AC:L)
  • Privileges Required: None (PR:N)
  • User Interaction: Required (UI:R)
  • CVSS v3.1 Score: 8.8 (HIGH)
  • Exploit Status: None / Unproven
  • CISA KEV Status: Not Listed

Affected Systems

  • Microsoft .NET 8.0
  • Microsoft .NET 9.0
  • Microsoft .NET 10.0
  • Microsoft .NET 11.0
  • Microsoft Visual Studio 2022 (v17.14)
  • Microsoft Visual Studio 2026 (v18.10)
  • .NET 8.0: >= 8.0.0, < 8.0.32 (Fixed in: 8.0.32)
  • .NET 9.0: >= 9.0.0, < 9.0.21 (Fixed in: 9.0.21)
  • .NET 10.0: >= 10.0.0, < 10.0.13 (Fixed in: 10.0.13)
  • .NET 11.0: >= 11.0.0, < 11.0.0-rc.2 (Fixed in: 11.0.0-rc.2)
  • Visual Studio 2022: >= 17.14.0, < 17.14.42 (Fixed in: 17.14.42)
  • Visual Studio 2026: >= 18.10.0, < 18.10.4 (Fixed in: 18.10.4)

Code Analysis

Commit: 0987b40

Fix clipboard auto-convert parameters to enforce autoConvert: false during typed data checks.

Commit: 8dd1964

Servicing update patch for PresentationCore clipboard validation.

Mitigation Strategies

  • Upgrade .NET SDK and runtime components to fixed servicing releases.
  • Explicitly set autoConvert: false when querying external IDataObject contents in WPF application code.
  • Restrict user execution privileges for applications interacting with untrusted clipboard inputs.

Remediation Steps:

  1. Identify all installed instances of .NET 8.0, 9.0, 10.0, 11.0, and Visual Studio build hosts.
  2. Apply security update builds: .NET 8.0.32, .NET 9.0.21, .NET 10.0.13, or .NET 11.0.0-rc.2.
  3. Update Visual Studio 2022 installations to 17.14.42 and Visual Studio 2026 to 18.10.4.
  4. Recompile WPF applications against the updated target SDKs.

References

Read the full report for CVE-2026-87697 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)