.NET WPF Runtime EUVD-2026-100196

Exploitation requires the victim to open or execute crafted WPF content containing malicious pixel-shader bytecode that desynchronizes the two parsing passes in CPSTrans::Initialize (CVSS UI:R confirms required user interaction). The affected component is the WPF desktop runtime (Microsoft.WindowsDesktop.App.Runtime) on Windows, so only applications built on .NET/.NET Framework WPF are exposed - pure server-side or non-WPF .NET workloads are not in the vulnerable code path. Limiting factors: user interaction is mandatory (no drive-by/zero-click or automatable mass exploitation, confirmed by SSVC Automatable=no), code executes in the context of the user running the WPF application rather than at elevated privilege (S:U), and the target must be running an unpatched affected version (e.g., .NET 9.0.0-9.0.20, 10.0.0-10.0.12, or affected .NET Framework builds).

This is a genuine, high-priority vulnerability but not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8 High) indicates a network-reachable, low-complexity, unauthenticated memory-corruption flaw with full confidentiality/integrity/availability impact, which aligns with the CWE-787 out-of-bounds write and the GHSA description of heap OOB writes in WPF's CPSTrans::Initialize pixel-shader parser. However, several signals temper the raw score: the vector requires user interaction (UI:R), so this is not a wormable, zero-click network exploit - it is content-driven RCE that needs a victim to open or run crafted WPF content. The SSVC framework corroborates lower urgency: Exploitation=none (no observed exploitation), Automatable=no (cannot be mass-automated, consistent with the UI:R requirement), though Technical Impact=total (matches the C:H/I:H/A:H). There is no CISA KEV listing and no POC/exploit-code indicator in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' Net assessment: patch on a normal priority cadence - the total technical impact and ubiquity of .NET warrant timely remediation, but the user-interaction requirement and absence of any exploitation evidence mean this is not a drop-everything scenario like an automatable unauthenticated server RCE.

An attacker crafts malicious WPF pixel-shader bytecode (e.g., embedded in a .NET desktop application, document, or downloadable content) designed to desynchronize the two parsing passes in CPSTrans::Initialize. The victim opens or runs the crafted WPF content, triggering a heap out-of-bounds write that corrupts memory and leads to arbitrary code execution in the context of the user running the application. No public exploit code is identified at time of analysis, and the low attack complexity (AC:L) suggests reliable exploitation is feasible once a working primitive is developed.