EUVD-2026-56410
GHSA-9mrh-pw7c-9mqm
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
No attacker privileges required (PR:N); user must open a crafted document (UI:R); impact is confidentiality-only via network information leakage, with no integrity or availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to disclose information over a network.
AnalysisAI
Information disclosure in Windows Presentation Foundation (WPF) within .NET 8, 9, and 10 allows an unauthenticated network attacker to exfiltrate sensitive data when a target user opens a specially crafted document. The WPF document parser resolves external references from attacker-controlled URIs - an SSRF-adjacent primitive (CWE-829, CWE-918) - causing outbound network requests that can expose authentication tokens or internal metadata to the attacker's infrastructure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target must open a specially crafted WPF document using a vulnerable .NET runtime on Windows - user interaction is explicitly required (CVSS UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 6.5 Medium is well-calibrated: AV:N/AC:L/PR:N reflects broad network reachability with no attacker prerequisites, while UI:R materially limits automation - mass exploitation requires delivering and getting users to open crafted documents, not a fully hands-off attack chain. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious WPF document that embeds external resource references (e.g., a remote XAML include or image URI) pointing to an attacker-controlled server, then delivers it via a phishing email or compromised file share. When the target opens the document in a WPF-based application on a vulnerable .NET runtime, the parser resolves the external URI and issues an outbound HTTP request - potentially carrying Windows NTLM authentication headers - which the attacker captures, enabling credential relay or offline cracking. … |
| Remediation | Vendor-released patches are available for all affected versions. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Visual Studio 2022
View allDenial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
.NET and Visual Studio Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely e
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service ove
Privilege escalation in Microsoft .NET runtimes (8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022 and 2026 results f
Heap-based buffer overflow (CWE-122) in Microsoft .NET enables local code execution across all actively supported .NET r
Local code execution via out-of-bounds write in Microsoft .NET allows an unauthenticated local attacker to achieve full
Local privilege escalation in Microsoft .NET (versions 8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022/2026 allows
Denial-of-service in Microsoft .NET runtimes and Visual Studio allows unauthenticated remote attackers to crash or hang
Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process com
Use-after-free memory corruption in Microsoft's QUIC protocol implementation (MsQuic) exposes sensitive heap memory to u
HTTP request smuggling in System.Net.HttpListener across .NET 8.0, 9.0, and 10.0 enables unauthenticated remote attacker
.NET and Visual Studio Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is re
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today