.NET WPF CVE-2026-85363

Requires a WPF-based .NET/.NET Framework application that renders XPS documents to process an attacker-supplied XPS file whose glyph coordinates are controlled by the attacker; the malformed coordinates overflow destination pointer arithmetic in CD3DGlyphBank::RectFillAlpha, causing an out-of-bounds write. Exploitation is LIMITED by required user interaction (UI:R - the victim must open/render the malicious document), restriction to the Windows platform, and the need for an application that actually handles untrusted XPS/glyph content; it does not affect server services that never process such documents. No elevated privileges are needed to trigger the flaw (PR:N).

Signals conflict and should be weighed carefully. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) looks severe, but the AV:N rating is really a network-delivered client-side flaw rather than a remotely reachable service: UI:R confirms a victim must open or render a malicious document, which materially lowers real-world exploitability. CISA's SSVC framework reinforces a lower operational priority - Exploitation: none (no observed activity), Automatable: no (cannot be reliably scripted at scale because it needs user interaction), though Technical Impact: total aligns with the C:H/I:H/A:H claim. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept provided, so this is 'no public exploit identified at time of analysis'. Net assessment: a high-severity but not emergency-priority memory-corruption bug. It is a real patch-worthy issue (ubiquitous framework, total technical impact) but current evidence points to no active exploitation and no trivial mass exploitation - prioritize patching for endpoints that render untrusted XPS content, below any actively-exploited items. Note a description/mechanism discrepancy: the NVD description frames this as 'elevate privileges over a network,' while the vendor GHSA describes an XPS glyph integer overflow causing an out-of-bounds write and process termination (memory-corruption/RCE/DoS) - verify the exact impact class with Microsoft's MSRC advisory.

An attacker crafts a malicious XPS document containing manipulated glyph coordinates and delivers it to a victim (e.g., via email or a download link). When the victim opens or renders the document in a WPF-based .NET application, attacker-controlled coordinates overflow destination pointer arithmetic in CD3DGlyphBank::RectFillAlpha, producing an out-of-bounds write that can crash the process or lead to code execution. No public exploit code is identified at time of analysis, and user interaction (opening the document) is required (UI:R).