WindowsDesktop.App Runtime EUVD-2026-100207

Exploitation requires a victim to open or navigate a crafted XAML or XPS document (or content that causes WPF to fetch a remote URI/TrueType font) within a WPF-based .NET desktop application on Windows; the flaw abuses unsafe URI fetching/navigation, propagation of untrusted-input state through hyperlink navigation, TrueType font handling, and cached positive DNS zone-policy decisions. Limiting factors that reduce real-world risk: mandatory user interaction (UI:R - the user must actively open attacker-controlled content), high attack complexity (AC:H - specific conditions in the parsing/navigation path must be met), and platform restriction to Windows WPF applications only (not ASP.NET or cross-platform .NET workloads). Although no authentication is needed (PR:N, unauthenticated), the required victim action and complexity meaningfully constrain exploitation.

This is a moderate-severity information-disclosure flaw whose real-world priority is low-to-moderate. The signals are internally consistent and point away from urgency: the CVSS 3.1 base score is 5.3 with AV:N/AC:H/PR:N/UI:R, meaning that although the vector is network-reachable and needs no privileges, exploitation requires both high attack complexity and user interaction (opening/navigating a crafted document). CISA SSVC reinforces this - Exploitation: none, Automatable: no, Technical Impact: partial - so there is no evidence of exploitation and the attack cannot be reliably scripted at scale. No EPSS score was supplied, the CVE is NOT in CISA KEV, and no POC is referenced, so exploitation status is 'no public exploit identified at time of analysis.' The only impact is confidentiality (C:H, I:N, A:N): disclosure of information, not code execution or tampering. There is no conflict between the network vector and the description - the GHSA advisory confirms the mechanism is unsafe URI fetching/navigation in WPF (XAML/XPS), which is genuinely reached over a network but gated behind a user opening untrusted content. Bottom line: a real-but-low-urgency patch-on-schedule item, not an emergency; the combination of AC:H, UI:R, SSVC 'none/no/partial' strongly argues against widespread or automated exploitation.

An attacker crafts a malicious XAML or XPS document (or a document that triggers WPF to fetch a remote URI/font) and delivers it to a victim via email or a web download. When the victim opens or navigates the content in a WPF-based .NET desktop application, flawed origin validation causes the application to fetch or expose data it should not, disclosing sensitive information to the attacker over the network. No public exploit code is identified, and the high attack complexity plus required user interaction make opportunistic exploitation difficult.