CVE-2026-96235: 
C# vulnerability analysis and mitigation

CVE-2026-96235 is a Remote Code Execution vulnerability caused by an out-of-bounds write (CWE-787) in the .NET Windows Presentation Foundation (WPF) runtime (Microsoft.WindowsDesktop.App.Runtime). Crafted WPF pixel-shader bytecode can desynchronize the two parsing passes in CPSTrans::Initialize, triggering heap out-of-bounds writes or reads. Affected products include .NET 8.0 (< 8.0.32), .NET 9.0 (< 9.0.21), .NET 10.0 (< 10.0.13), .NET 11.0 (< 11.0.0-rc.2), Visual Studio 2022 version 17.14 (< 17.14.42), and Visual Studio 2026 version 18.10 (< 18.10.4). The vulnerability was disclosed and patched on October 13, 2026, with a CVSS v3.1 base score of 8.8 (High) (MSRC Advisory, GitHub Advisory).

The root cause is an out-of-bounds write (CWE-787) in the WPF pixel-shader processing component. Specifically, crafted pixel-shader bytecode supplied to a WPF application can desynchronize the two parsing passes within CPSTrans::Initialize, causing the runtime to write data beyond the bounds of an allocated heap buffer. Exploitation requires network delivery of a malicious artifact (e.g., a crafted document or application resource) and user interaction — such as opening a file or visiting a page that triggers WPF rendering — but requires no authentication or elevated privileges. The vulnerability is Windows-platform specific and affects all architectures (x86, x64, arm64) (GitHub Advisory, MSRC Advisory).

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary code with the privileges of the .NET application process, resulting in high confidentiality, integrity, and availability impact. An attacker who achieves code execution could access sensitive data, modify application state, crash the process, or use the compromised process as a foothold for lateral movement within the environment. The scope is limited to Windows systems running affected .NET WPF runtimes, including self-contained applications that bundle the vulnerable runtime (GitHub Advisory, MSRC Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (MSRC Advisory). The EPSS score is 0.0, reflecting low current exploitation probability, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation is not fully automated (marked "not automatable" by NVD SSVC) due to the required user interaction component. The vulnerability was discovered and reported by Mateusz Gierblinski with Curios (GitHub Advisory).

1. Craft malicious payload: Create a WPF-compatible file (e.g., a .xaml document, WPF application, or embedded resource) containing specially crafted pixel-shader bytecode designed to desynchronize the two parsing passes in CPSTrans::Initialize.
2. Deliver payload to target: Distribute the malicious file via phishing email, malicious website, or shared network resource, targeting users running WPF-enabled .NET applications on Windows.
3. Trigger user interaction: Induce the victim to open the crafted file or navigate to content that causes the vulnerable WPF runtime to process the malicious pixel-shader bytecode.
4. Trigger heap out-of-bounds write: The desynchronized parsing passes cause the runtime to write attacker-controlled data beyond the intended heap buffer boundary in CPSTrans::Initialize.
5. Achieve code execution: Leverage the heap corruption to redirect execution flow, ultimately executing arbitrary code with the privileges of the WPF application process (GitHub Advisory).

• Network: Delivery of unexpected .xaml, .xbap, or WPF-related files from external or untrusted sources; unusual outbound connections from WPF application processes following file open events.
• File System: Presence of unexpected or externally sourced .xaml files or WPF resources containing embedded pixel-shader bytecode; newly created files or executables in user-writable directories following WPF application execution.
• Logs: Application crash logs or Windows Event Log entries (Event ID 1000/1001) referencing WPF or .NET runtime heap corruption exceptions; Dr. Watson or Windows Error Reporting dumps from WPF processes.
• Process: Unusual child processes spawned by WPF application processes (e.g., cmd.exe, powershell.exe, mshta.exe); unexpected network activity from WPF application processes.

Microsoft has released patched versions addressing this vulnerability: .NET 8.0.32, .NET 9.0.21, .NET 10.0.13, .NET 11.0.0-rc.2, Visual Studio 2022 version 17.14.42, and Visual Studio 2026 version 18.10.4. Developers should update the Microsoft.WindowsDesktop.App.Runtime NuGet package references to the patched versions and restart affected applications. Self-contained applications bundling the vulnerable runtime must be recompiled and redeployed against the patched SDK. Visual Studio users will be prompted to update via the IDE, which will also update the bundled .NET SDKs (GitHub Advisory, MSRC Advisory).

The vulnerability was covered as part of the broader Microsoft October 2026 Patch Tuesday cycle, which addressed over 1,400 flaws. Security media including BleepingComputer and Zero Day Initiative (ZDI) included it in their Patch Tuesday roundups (ZDI Blog, BleepingComputer). No significant independent researcher commentary or notable social media discussion specific to this CVE has been observed beyond standard Patch Tuesday coverage.