GHSA-gh2h-rhph-h37g BIT-dotnet-2026-50646 BIT-dotnet-sdk-2026-50646 CVE-2026-50646
Microsoft Security Advisory CVE-2026-50646 – .NET Remote Code Execution Vulnerability
- Severity
- 7.8 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 4.02%
- Chance of exploitation in the next 30 days. Higher than 90.57% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Fix
- Available
- 3 packages have a fixed version
Description
Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in Windows Presentation Foundation (WPF). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
A remote code execution vulnerability exists in Windows Presentation Foundation (WPF) in .NET 8, .NET 9, and .NET 10 when parsing specially crafted XAML input. An attacker who successfully exploits this vulnerability could execute arbitrary code in the context of the current user.
Announcement
Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/TBD
CVSS Details
- Version: 3.1
- Severity: High
- Score: 7.8
- Vector:
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness: CWE-693 (Protection Mechanism Failure)
Affected Platforms
- Platforms: Windows
- Architectures: All
<a name="affected-packages"></a>Affected Packages
The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed below
<a name=".NET 10.0"></a>.NET 10.0
| Package name | Affected version | Patched version |
|---|---|---|
| Microsoft.WindowsDesktop.App.Runtime.win-arm64 | >= 10.0.0, <= 10.0.9 | 10.0.10 |
| Microsoft.WindowsDesktop.App.Runtime.win-x64 | >= 10.0.0, <= 10.0.9 | 10.0.10 |
| Microsoft.WindowsDesktop.App.Runtime.win-x86 | >= 10.0.0, <= 10.0.9 | 10.0.10 |
<a name=".NET 9.0"></a>.NET 9.0
| Package name | Affected version | Patched version |
|---|---|---|
| Microsoft.WindowsDesktop.App.Runtime.win-arm64 | >= 9.0.0, <= 9.0.17 | 9.0.18 |
| Microsoft.WindowsDesktop.App.Runtime.win-x64 | >= 9.0.0, <= 9.0.17 | 9.0.18 |
| Microsoft.WindowsDesktop.App.Runtime.win-x86 | >= 9.0.0, <= 9.0.17 | 9.0.18 |
<a name=".NET 8.0"></a>.NET 8.0
| Package name | Affected version | Patched version |
|---|---|---|
| Microsoft.WindowsDesktop.App.Runtime.win-arm64 | >= 8.0.0, <= 8.0.28 | 8.0.29 |
| Microsoft.WindowsDesktop.App.Runtime.win-x64 | >= 8.0.0, <= 8.0.28 | 8.0.29 |
| Microsoft.WindowsDesktop.App.Runtime.win-x86 | >= 8.0.0, <= 8.0.28 | 8.0.29 |
Advisory FAQ
<a name="how-affected"></a>How do I know if I am affected?
If using a package listed in affected packages, developers exposed to the vulnerability.
<a name="how-fix"></a>How do I fix the issue?
- To fix the issue please install the latest version of .NET. If developers have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt them to update Visual Studio, which will also update their .NET SDKs.
- If their application references the vulnerable nuget package, update the package reference to the patched version. Developers can list the versions they have installed by running the
dotnet --infocommand.
Once developers have installed the updated runtime or SDK, they should restart their apps for the update to take effect.
Additionally, if they've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.
Other Information
Reporting Security Issues
If anyone has found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.
Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.
Support
Direct questions about this issue to GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. Users can ask questions in the linked discussion issue.
Disclaimer
The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.
External Links
Acknowledgements
Kevin Gosse, 41ae55e9310ff27fa6f26af4727e5590, Ky0toFu
Revisions
V1.0 (July 14, 2026): Advisory published.
Affected versions
NuGet
| Package | Vulnerable | Fixed in |
|---|---|---|
| Microsoft.WindowsDesktop.App.Runtime.win-arm64 | >= 10.0.0, < 10.0.10 |
10.0.10 |
| Microsoft.WindowsDesktop.App.Runtime.win-arm64 | >= 9.0.0, < 9.0.18 |
9.0.18 |
| Microsoft.WindowsDesktop.App.Runtime.win-arm64 | >= 8.0.0, < 8.0.29 |
8.0.29 |
| Microsoft.WindowsDesktop.App.Runtime.win-x64 | >= 10.0.0, < 10.0.10 |
10.0.10 |
| Microsoft.WindowsDesktop.App.Runtime.win-x64 | >= 9.0.0, < 9.0.18 |
9.0.18 |
| Microsoft.WindowsDesktop.App.Runtime.win-x64 | >= 8.0.0, < 8.0.29 |
8.0.29 |
| Microsoft.WindowsDesktop.App.Runtime.win-x86 | >= 10.0.0, < 10.0.10 |
10.0.10 |
| Microsoft.WindowsDesktop.App.Runtime.win-x86 | >= 9.0.0, < 9.0.18 |
9.0.18 |
| Microsoft.WindowsDesktop.App.Runtime.win-x86 | >= 8.0.0, < 8.0.29 |
8.0.29 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
Microsoft.WindowsDesktop.App.Runtime.win-arm64 NuGet → 10.0.10
- dotnet
dotnet add package Microsoft.WindowsDesktop.App.Runtime.win-arm64 --version 10.0.10
Microsoft.WindowsDesktop.App.Runtime.win-x64 NuGet → 10.0.10
- dotnet
dotnet add package Microsoft.WindowsDesktop.App.Runtime.win-x64 --version 10.0.10
Microsoft.WindowsDesktop.App.Runtime.win-x86 NuGet → 10.0.10
- dotnet
dotnet add package Microsoft.WindowsDesktop.App.Runtime.win-x86 --version 10.0.10
Severity breakdown
CVSS 3.1 7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
How to prevent it
- Architecture and Design, Implementation: If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
- Implementation: When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.
- Implementation: Explicitly define a final object() to prevent deserialization.
- Architecture and Design, Implementation: Make fields transient to protect them from deserialization. An attempt to serialize and then deserialize a class containing transient fields will result in NULLs where the transient data should be. This is an excellent way to prevent time, environment-based, or sensitive variables from being carried over and used improperly.
- Implementation: Avoid having unnecessary types or gadgets (a sequence of instances and method invocations that can self-execute during the deserialization process, often found in libraries) available that can be leveraged for malicious ends. This limits the potential for unintended or unauthorized types and gadgets to be leveraged by the attacker. Add only acceptable classes to an allowlist. Note: new gadgets are constantly being discovered, so this alone is not a sufficient mitigation.
- Architecture and Design, Implementation: Employ cryptography of the data or code for protection. However, it's important to note that it would still be client-side security. This is risky because if the client is compromised then the security implemented on the client (the cryptography) can be bypassed.
- Operation: Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].
CWE-693: Protection Mechanism Failure
The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-g44w-h65v-4cw9 Microsoft Security Advisory CVE-2026-96235 - .NET and Visual Studio Remote Code Execution Vulnerability | High | Also affects Microsoft.WindowsDesktop.App.Runtime.win-arm64 |
| GHSA-fq6x-pvr9-888r Microsoft Security Advisory CVE-2026-96234 - .NET and Visual Studio Information Disclosure Vulnerability | Medium | Also affects Microsoft.WindowsDesktop.App.Runtime.win-arm64 |
| GHSA-f8qh-mqg4-9939 Microsoft Security Advisory CVE-2026-96232 - .NET and Visual Studio Information Disclosure Vulnerability | High | Also affects Microsoft.WindowsDesktop.App.Runtime.win-arm64 |
| GHSA-5qr9-xxm9-6cmq Microsoft Security Advisory CVE-2026-96229 - .NET and Visual Studio Information Disclosure Vulnerability | Medium | Also affects Microsoft.WindowsDesktop.App.Runtime.win-arm64 |
| GHSA-xq57-crx4-g373 Microsoft Security Advisory CVE-2026-96224 - .NET and Visual Studio Remote Code Execution Vulnerability | High | Also affects Microsoft.WindowsDesktop.App.Runtime.win-arm64 |
| GHSA-c27m-942f-rcfh Microsoft Security Advisory CVE-2026-87697 - .NET and Visual Studio Remote Code Execution Vulnerability | High | Also affects Microsoft.WindowsDesktop.App.Runtime.win-arm64 |
| GHSA-f63g-mx39-3r38 Microsoft Security Advisory CVE-2026-85363 - .NET and Visual Studio Remote Code Execution Vulnerability | High | Also affects Microsoft.WindowsDesktop.App.Runtime.win-arm64 |
| GHSA-4w5f-7jp2-w48g Microsoft Security Advisory CVE-2026-83520 - .NET and Visual Studio Remote Code Execution Vulnerability | High | Also affects Microsoft.WindowsDesktop.App.Runtime.win-arm64 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor