EUVD-2026-29634
GHSA-8x9c-mqxv-q2pp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious input for WPF app
-
DeliveryDeliver file to local user
-
ExploitUser opens crafted input
-
ExecutionTrigger heap overflow in .NET runtime
-
ImpactExecute code and elevate privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires local access to the target system and a targeted user to open or process attacker-controlled input in an application built on the affected .NET Windows Desktop/WPF runtime (UI:R in the CVSS vector). No prior authentication or elevated privileges are needed by the attacker (PR:N), but the mandatory user interaction and local-only vector (AV:L) are the key limiting factors - this cannot be triggered remotely over a network without a user opening the malicious content, and only Windows deployments running affected .NET 8.0/9.0/10.0 desktop runtime versions are exploitable. |
| Impact | Signals are mixed and point to a real but non-urgent priority. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L, base 7.3 High) describes a local attack requiring user interaction but no prior privileges, with high confidentiality/integrity impact. CISA SSVC rates Exploitation as 'none' (no observed exploitation) and Automatable as 'no', while Technical Impact is 'total' - so severity of outcome is high but scalability and current exploitation are low. EPSS is low at 0.11% (30th percentile), consistent with the SSVC 'none' exploitation status, yet public POC/exploit code does exist (a GitHub gist), so capability is available even if active exploitation is not observed. Note a partial tension: the 'Authentication Bypass' tag suggests auth-bypass framing, but the CVSS scope is Unchanged and the described impact is local privilege elevation via memory corruption, not a remote auth bypass - treat the tag cautiously. Net: patch on a normal-to-prompt cycle; this is not a mass-exploitation network threat but is a credible local EoP with working exploit code. |
| Exploit ScenarioDerived | An attacker crafts malicious input (e.g., a file or data payload) processed by a vulnerable WPF/.NET desktop application and delivers it to a local user; when the user opens it, improper input validation triggers a heap-based buffer overflow that lets the attacker execute code and elevate privileges on the host. Publicly available exploit code (a GitHub gist) lowers the barrier to weaponization, though the local vector and required user interaction limit scale. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Local privilege elevation in Microsoft .NET (Windows Desktop/WPF runtime) for versions 8.0, 9.0, and 10.0 allows an attacker to run code at a higher privilege level after a targeted user opens crafted input. The root cause combines improper input validation (CWE-20) with a heap-based buffer overflow (CWE-122), yielding total technical impact per CISA SSVC. Publicly available exploit code exists, but the vulnerability is not in CISA KEV and EPSS is low (0.11%, 30th percentile), indicating no observed widespread exploitation to date.
RemediationAI
Vendor-released patch: upgrade to .NET 8.0.27, 9.0.16, or 10.0.8 (or later) as appropriate for your runtime, updating the affected Microsoft.WindowsDesktop.App.Runtime.win-arm64/x64/x86 NuGet packages and redeploying dependent WPF applications; apply the latest Windows/.NET servicing update from Microsoft. Consult https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35433, the announcement at https://github.com/dotnet/announcements/issues/398, and the advisory https://github.com/dotnet/wpf/security/advisories/GHSA-8x9c-mqxv-q2pp. Because exploitation requires a user to open attacker-supplied input in an affected desktop application, where immediate patching is not possible reduce risk by restricting which untrusted files/inputs are opened by WPF/.NET desktop apps and by limiting execution to least-privilege user accounts to reduce the value of a local elevation; these controls reduce but do not eliminate exposure and may impact user workflows that legitimately open external files.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 6 packages in nuget, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Windows Desktop runtime shipped with .NET (the Microsoft.WindowsDesktop.App.Runtime.win-arm64/x64/x86 packages), which underpins WPF desktop applications; the security advisory is published under the dotnet/wpf repository. CPE data confirms the affected products are Microsoft .NET 8.0, 9.0, and 10.0 on Windows across all architectures. The weakness is classified as CWE-20 (Improper Input Validation) by NVD and additionally CWE-122 (Heap-based Buffer Overflow) by Microsoft's advisory, meaning attacker-controlled input is not properly validated before being processed into a heap buffer, allowing memory corruption that can be leveraged to elevate privileges locally.
Know when Net 10 0 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
Local vector and required user interaction to open crafted input (AV:L, UI:R); no attacker privileges needed (PR:N); memory corruption yields high C/I and partial availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally.
Executive ViewAI
Microsoft .NET Windows Desktop Runtime versions 8.0 through 10.0 contain a privilege escalation vulnerability that allows local attackers to achieve system-level access by delivering crafted input to targeted users. While no widespread exploitation has been observed to date, publicly available exploit code exists and poses material risk to organizations with .NET-dependent desktop applications across the enterprise. Immediate patching is critical to prevent potential system compromise.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Security feature bypass in Microsoft .NET (versions 8.0, 9.0, and 10.0) lets a remote, unauthenticated attacker circumve
Infinite loop denial-of-service vulnerability in Microsoft .NET Framework (3.5 through 4.8.1), .NET 8.0, 9.0, and 10.0 a
Network denial of service in Microsoft .NET 8.0, 9.0, and 10.0 (and the corresponding Visual Studio 2022/2026 tooling) a
Network-based denial of service in Microsoft .NET 8.0, 9.0, and 10.0 allows an unauthenticated remote attacker to exhaus
Denial-of-service condition in Microsoft .NET Framework 8.0, 9.0, and 10.0 allows unauthenticated remote attackers to ex
Remote denial of service in ASP.NET Core (.NET 8.0, 9.0, and 10.0) allows an unauthenticated attacker to send crafted ne
Local privilege escalation in Microsoft .NET Framework (versions 3.5 through 10.0) and Visual Studio 2017 occurs through
Output spoofing via improper encoding in Microsoft .NET 8.0, 9.0, and 10.0 allows a low-privileged network attacker to m
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Absolute path traversal in Microsoft .NET Core (Windows runtime, versions 8.0 through 10.0) enables a network-accessible
Denial of service in Microsoft .NET (versions 8.0, 9.0, and 10.0) allows a remote, unauthenticated attacker to crash or
Exploit-DB