.NET WPF CVE-2026-87697

Exploitation requires a Windows WPF application built on an affected Microsoft.WindowsDesktop.App.Runtime version (8.0.0-8.0.31, 9.0.0-9.0.20, 10.0.x before 10.0.13, or 11.0.0-preview.1-rc.1) that renders XPS content exposed through UI Automation. The attacker must get a victim to interact with attacker-supplied content (UI:R) so that a synthetic hyperlink bypasses the app's restrictive navigation checks and reaches attacker-controlled content. Limiting factors: exploitation is client-side and Windows-only, depends on the victim running a vulnerable WPF/XPS app and performing the interaction, and succeeds only against unpatched runtime versions; it is not a server-side or zero-click vector despite PR:N.

This is a genuinely serious but interaction-gated vulnerability rather than a mass-exploitable network worm. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) shows network reach, low complexity, and no privileges required, but the UI:R flag is decisive: a user must interact (e.g., open attacker-supplied content in a vulnerable WPF application) before code runs. No EPSS score was provided, this CVE is not listed in CISA KEV, and no public exploit was supplied, so exploitation status is 'no public exploit identified at time of analysis.' Note a signal conflict worth verifying: the NVD-style description and CWE-502 frame this as deserialization of untrusted data, while the authoritative dotnet/wpf GHSA advisory describes the actual mechanism as WPF XPS synthetic hyperlinks exposed through UI Automation bypassing restrictive navigation checks to reach attacker-controlled content - the deserialization label and the advisory's navigation-bypass narrative do not cleanly align, so defenders should treat the GHSA advisory as the ground truth for mitigation. Overall this warrants prompt patching for any Windows desktop fleet running WPF apps on affected .NET runtimes, but the mandatory user interaction and desktop-only (client-side) exposure make it a lower immediate priority than an unauthenticated server-side RCE of the same score.

An attacker crafts a malicious XPS document or content containing a synthetic hyperlink and lures a victim into opening or interacting with it inside a WPF application built on an affected Microsoft.WindowsDesktop.App.Runtime version. The synthetic hyperlink exposed via UI Automation bypasses the application's restrictive navigation checks and reaches attacker-controlled content, resulting in code execution in the context of the user running the app. No public exploit code was identified at time of analysis, and user interaction (UI:R) is required for the chain to complete.