Microsoft Security Advisory CVE-2026-70007 - .NET and Visual Studio Remote Code Execution Vulnerability

Executive Summary

Microsoft has released a security advisory regarding a vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF). Crafted WPF pixel-shader bytecode can desynchronize the two parsing passes in CPSTrans::Initialize, leading to heap out-of-bounds writes or reads.

Announcement

The official announcement for this issue is available at https://github.com/dotnet/announcements/issues/450.

CVSS Details

• Version: 3.1
• Severity: High
• Score: 8.8
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Weakness: CWE-787 (Out-of-bounds Write)

Affected Platforms

• Platforms: Windows
• Architectures: All

Affected Packages

This vulnerability affects Microsoft .NET projects using any of the package versions listed below:

Advisory FAQ

How do I know if I am affected?

If you are using any package version listed in the Affected Packages table, your project is exposed to the vulnerability.

How do I fix the issue?

• 1. To resolve the issue, install the latest version of .NET. If you installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to apply an update, which will update your .NET SDKs as well.
• 2. If your application references a vulnerable package, update the reference to the patched version. You can check the installed versions by executing the dotnet --info command.

After installing the updated runtime or SDK, restart your applications for the changes to take effect.

In addition, if you have deployed self-contained applications) targeting any of the affected versions, those applications are also vulnerable and must be recompiled and redeployed.

Other Information

Reporting Security Issues

If you discover a potential security issue in a supported version of .NET, report it to the Microsoft Security Response Center (MSRC) using the MSRC Researcher Portal.). Additional details are provided in the MSRC Report an Issue FAQ.).

Reports submitted through the MSRC may qualify for the Microsoft .NET Bounty. Details and program terms are available at https://aka.ms/corebounty..

Support

Questions regarding this advisory can be submitted on GitHub within the .NET GitHub organization. The primary repositories are located at https://github.com/dotnet/runtime.. The Announcements repository (https://github.com/dotnet/Announcements)) includes this bulletin as an issue with a link to a dedicated discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

• CVE-2026-70007)

Acknowledgements

• phrolo7a
• Muhammad Abdul Rehman
• SOMESH SONUNE
• Matheus Siqueira
• thegoldmandm
• Aobo Wang (@m4x_1997)
• Mateusz Gierblinski with Curios (https://curios-it.eu/))
• m0ssser (https://m0ssser-portfolio.pages.dev/))
• Alex Hannah

Revisions

V1.0 (10/13/2026): Advisory published.