.NET WPF EUVD-2026-100198

Exploitation requires a victim to open or load attacker-crafted content (XAML/XPS document or untrusted serialized data) in a vulnerable WPF application built on an affected runtime - the GHSA advisory ties the fix to unsafe XAML/XPS URI fetching, hyperlink navigation, TrueType font handling, and XAML nesting-depth limits. The decisive limiting factor is UI:R: no exploitation occurs without user interaction, and the affected code path is Windows-only (Microsoft.WindowsDesktop.App.Runtime), so headless/server .NET deployments without WPF are not in scope. No authentication is required (PR:N), but the mandatory user action and non-automatable nature (SSVC Automatable=no) substantially narrow real-world exploitability versus the raw 8.8 score.

Signals are mixed and point to serious-but-not-emergency priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8 High) describes a network-reachable, unauthenticated, low-complexity RCE whose only gating factor is required user interaction (UI:R) - consistent with CWE-502 deserialization triggered when a victim opens or loads crafted content. CISA's SSVC assessment contradicts an emergency reading: Exploitation=none and Automatable=no, while Technical Impact=total aligns with the C:H/I:H/A:H rating. No EPSS score was supplied, no CISA KEV listing is present, and no public exploit is referenced, so there is no public exploit identified at time of analysis. The practical interpretation: this is a high-impact code-execution flaw in extremely widely deployed Microsoft runtimes, but exploitation is not automatable and depends on tricking a user, so it is a 'patch promptly' item rather than an actively-exploited fire-drill. Note a scope nuance: the one-line NVD description says 'unauthorized attacker ... over a network,' but the Microsoft/dotnet GHSA source evidence makes clear the real defect is in WPF (Microsoft.WindowsDesktop.App.Runtime) involving unsafe XAML/XPS URI fetching, navigation, and deserialization - verify the delivery model against vendor guidance.

An attacker crafts a malicious XAML/XPS document or data payload and delivers it to a victim (e.g., via email, download, or a link that a vulnerable WPF application loads). When the user opens the content, the application deserializes the untrusted data and executes attacker-controlled code in the user's security context. No public exploit is identified at time of analysis, and the low attack complexity (AC:L) is offset by the required user interaction (UI:R).