CVE-2026-50646

A remote code execution vulnerability exists in Windows Presentation Foundation (WPF) in Microsoft .NET 8, 9, and 10 when the framework parses specially crafted XAML input (tracked as CWE-502 deserialization of untrusted data and CWE-693 protection mechanism failure). The flaw is triggered when a Windows application built on the affected .NET Desktop runtimes processes maliciously crafted XAML, and the CVSS vector (AV:L/UI:R) indicates exploitation requires a local attacker and user interaction, such as a user opening malicious content that a vulnerable app parses. A successful exploit lets the attacker execute arbitrary code in the context of the current user, with high impact on confidentiality, integrity, and availability. Any .NET project running on Windows with affected versions of the Microsoft.WindowsDesktop.App.Runtime packages (x86, x64, or arm64) is affected, spanning .NET 8.0.0–8.0.28, 9.0.0–9.0.17, and 10.0.0–10.0.9. There is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at about 1%.

What to do: Update the Microsoft.WindowsDesktop.App.Runtime packages to 8.0.29 (for .NET 8), 9.0.18 (for .NET 9), or 10.0.10 (for .NET 10) and rebuild/redistribute affected Windows applications. In the interim, treat untrusted XAML as untrusted input and avoid having WPF-based applications parse XAML from unknown sources. Inventory Windows systems for apps built on the .NET Desktop runtime and prioritize updates for applications that accept XAML content from users or external files.