Key points
- The flaw affects .NET versions 8 through 11 across multiple Windows architectures.
- Microsoft has released patched versions for all affected runtime packages.
- The vulnerability is rated high severity with a CVSS score of 8.8.
Microsoft has issued security updates for a remote code execution vulnerability affecting Microsoft .NET projects that use the Windows Presentation Foundation (WPF) component. The issue, tracked as CVE-2026-96224, impacts runtime packages for versions 8, 9, 10, and 11 of the .NET framework. According to the Microsoft Security Update Guide, an unauthorized attacker can exploit this flaw over a network to execute code on affected systems. The vulnerability stems from an out-of-bounds write error within the WPF pixel-shader processing logic.
In plain English
The security flaw exists in how the .NET framework processes pixel shaders, which are small programs used to render graphics in WPF applications. A crafted piece of shader bytecode can confuse the parsing process, causing the system to write data to memory locations it should not access. This out-of-bounds write allows an attacker to run arbitrary code on the target machine. Microsoft describes the attack vector as network-based, meaning the flaw can be triggered remotely without prior access to the system, though user interaction is required.
The background
The vulnerability affects multiple versions of the Microsoft.WindowsDesktop.App.Runtime package across Windows operating systems. Affected versions include all releases of .NET 8 from 8.0.0 through 8.0.31, .NET 9 from 9.0.0 through 9.0.20, and .NET 10 from 10.0.0 through 10.0.12. Additionally, preview and release candidate versions of .NET 11, specifically from 11.0.0-preview.1 to 11.0.0-rc.1, are also vulnerable. The flaw applies to all Windows architectures, including x64, x86, and ARM64.
What changes now
Microsoft has released patched versions for all affected runtimes. For .NET 8, the fix is available in version 8.0.32. .NET 9 users should update to version 9.0.21. .NET 10 applications require an update to version 10.0.13. For .NET 11, the vulnerability is resolved in version 11.0.0-rc.2. These updates address the out-of-bounds write issue in the pixel-shader initialization process, preventing the desynchronization that allowed for remote code execution. The Common Vulnerability Scoring System rates this flaw as high severity with a score of 8.8.
Who needs to act first
Teams usually prioritize updating systems that face the internet, as network-based flaws pose the greatest immediate risk. Start with public-facing servers and applications that handle untrusted input, then move to internal development machines. Before rolling out the update, test the patched runtime in a staging environment to ensure application stability. Back up current configurations and source code to allow for quick rollback if issues arise. Coordinate with developers to rebuild and redeploy affected applications using the new runtime packages.
What to do and how to stay safe: Microsoft
- Inventory all systems running .NET versions 8, 9, 10, or 11 to identify those using vulnerable WPF runtimes.
- Test the updated runtime packages in a non-production environment before deploying them to live systems.
- Monitor network traffic for unusual activity that could indicate an attempt to exploit the pixel-shader flaw.
- Ensure all developer workstations are updated to the patched versions to prevent the use of vulnerable tooling.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does this vulnerability affect macOS or Linux versions of .NET?
The source material specifies that the affected platforms are Windows, listing Windows-specific runtime packages.
Is user interaction required to exploit this flaw?
Yes, the CVSS vector indicates that user interaction (UI:R) is required for the attack to succeed.
What is the specific technical cause of this vulnerability?
The flaw is an out-of-bounds write caused by crafted pixel-shader bytecode desynchronizing parsing passes.
