Key points
- The flaw affects .NET 8, 9, 10, and 11 preview runtimes on Windows.
- A CVSS 8.8 score indicates high severity with required user interaction.
- Fixes are available in specific patch versions for all affected releases.
Windows systems running specific versions of the Microsoft.WindowsDesktop.App.Runtime are affected by CVE-2026-70035, a high-severity remote code execution vulnerability in Windows Presentation Foundation. Microsoft released patches for versions 8 through 11, including preview builds. The flaw allows an attacker to execute code over a network if a user interacts with malicious content. This aligns with Patch Review’s recent coverage of high-impact runtime patches.
In plain English
The vulnerability involves how the software handles untrusted data during deserialization. If an attacker convinces a user to open a specially crafted file or view malicious content, the application may process unsafe instructions. This can lead to unauthorized code execution on the victim’s machine. The issue resides in the WPF components of the .NET runtime, not the broader .NET Framework itself.
The background
Microsoft’s security advisory details that the fix includes multiple protective measures. These updates block unsafe URI fetching and navigation, propagate untrusted-input states, add TrueType font protection, and limit XAML nesting depth. The changes also prevent caching positive DNS zone-policy decisions. The Common Vulnerability Scoring System rates the issue at 8.8, categorized as high severity.
What changes now
Developers and administrators must update their applications to use the patched runtime versions. For .NET 8, version 8.0.32 is required. .NET 9 users need version 9.0.21, and .NET 10 requires 10.0.13. Those using .NET 11 preview builds must upgrade to 11.0.0-rc.2. All fixes apply to arm64, x64, and x86 architectures.
Who needs to act first
Teams usually prioritize systems exposed to external networks or untrusted users. Check whether your applications handle external files or links. Begin by updating development and staging environments to verify compatibility. Back up current configurations before rolling out changes. Test thoroughly to ensure no functionality breaks. Once validated, deploy the updates to production systems with the highest exposure first.
What to do and how to stay safe: Microsoft
- Identify all applications using the affected Microsoft.WindowsDesktop.App.Runtime versions.
- Update to the latest patched versions for your specific .NET release.
- Monitor for any unusual behavior after applying the updates.
- Educate users to avoid opening untrusted files or clicking suspicious links.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which .NET versions are affected by CVE-2026-70035?
Versions 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12, and 11.0.0-preview.1 through 11.0.0-rc.1.
Is a fix available for this vulnerability?
Yes, Microsoft has released patched versions for all affected .NET releases, including 8.0.32, 9.0.21, 10.0.13, and 11.0.0-rc.2.
Does this vulnerability require user interaction?
Yes, the CVSS vector indicates that user interaction is required for exploitation.
