.NET WPF CVE-2026-70174

Requires a WPF application (Microsoft.WindowsDesktop.App.Runtime on Windows) that renders untrusted XPS content and permits hyperlink navigation; the attacker must supply a crafted document whose hyperlink URI evades WPF's navigation restriction check to reach an attacker-controlled ObjectDataProvider. Exploitation is gated by mandatory user interaction (UI:R) - the victim must open the document and activate the malicious hyperlink - which limits automation (SSVC Automatable=no) and means default, non-XPS-handling workflows are not exposed; it is Windows-only and limited to the unpatched runtime version ranges (e.g. .NET 8 <8.0.32, .NET 9 <9.0.21, .NET 10 <10.0.13, and the listed .NET Framework builds).

Signals are largely consistent and point to a real but interaction-gated threat. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8 HIGH) describes network-reachable, unauthenticated, low-complexity remote code execution that nonetheless requires user interaction - matching the GHSA description that WPF XPS hyperlink navigation bypasses URI restrictions to reach an attacker-controlled ObjectDataProvider 'after user interaction.' CISA SSVC moderates the urgency: Exploitation=none and Automatable=no (the required user click defeats worm-like automation), while Technical Impact=total aligns with the C:H/I:H/A:H full-compromise rating. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is not confirmed active exploitation. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. Net: a high-impact RCE that is a genuine patching priority given the ubiquity of the .NET/WPF runtime and the low complexity, but the mandatory user interaction and absence of KEV/POC signals make it a prompt-patch item rather than an emergency drop-everything 10/10. One labeling caveat: the input Tag 'Authentication Bypass' does not match the actual weakness, which is a security-check/URI-restriction bypass (CWE-358), not an authentication bypass - this is a metadata mismatch, not a change to the technical risk.

An attacker crafts a malicious XPS document (or a WPF-rendered page) containing a hyperlink whose URI evades WPF's navigation restrictions and resolves to an attacker-controlled ObjectDataProvider. The victim opens the document in a vulnerable WPF application and activates the hyperlink, causing arbitrary code to execute in the context of the application. No public exploit code has been identified at time of analysis.