EUVD-2026-56410
GHSA-9mrh-pw7c-9mqm
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
No attacker privileges required (PR:N); user must open a crafted document (UI:R); impact is confidentiality-only via network information leakage, with no integrity or availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
4DescriptionCVE.org
Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to disclose information over a network.
AnalysisAI
Information disclosure in Windows Presentation Foundation (WPF) within .NET 8, 9, and 10 allows an unauthenticated network attacker to exfiltrate sensitive data when a target user opens a specially crafted document. The WPF document parser resolves external references from attacker-controlled URIs - an SSRF-adjacent primitive (CWE-829, CWE-918) - causing outbound network requests that can expose authentication tokens or internal metadata to the attacker's infrastructure. No public exploit code or CISA KEV listing exists at time of analysis; vendor-released patches are available for all affected .NET and Visual Studio versions.
Technical ContextAI
Windows Presentation Foundation is Microsoft's XAML-based UI framework for Windows desktop applications. The root cause spans three CWEs confirmed by the GHSA advisory: CWE-829 (Inclusion of Functionality from Untrusted Control Sphere), CWE-918 (Server-Side Request Forgery), and the parent class CWE-693 (Protection Mechanism Failure). When WPF parses a crafted document, it resolves external resource URIs without adequate trust validation, triggering outbound network requests to attacker-controlled hosts. This is structurally similar to classic SSRF: the victim application becomes the request originator, potentially forwarding Windows authentication credentials (e.g., NTLM) to the attacker. Affected NuGet packages are Microsoft.WindowsDesktop.App.Runtime.win-arm64, win-x64, and win-x86 across .NET 8, 9, and 10. The flaw is Windows-only across all supported CPU architectures.
RemediationAI
Vendor-released patches are available for all affected versions. Upgrade the Microsoft.WindowsDesktop.App.Runtime packages (win-arm64, win-x64, win-x86) to version 8.0.30 for .NET 8, 9.0.19 for .NET 9, and 10.0.11 for .NET 10. Visual Studio 2022 users on the 17.14 channel should update to 17.14.38 or later; Visual Studio 2026 users on the 18.8 channel should update to 18.8.3 or later. Full patch guidance is at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62902 and release notes at https://github.com/dotnet/announcements/issues/433. Where immediate patching is not possible, implement strict egress firewall rules blocking outbound HTTP/HTTPS from workstations to non-approved external destinations - this disrupts the attacker's ability to receive the leaked data but may impact legitimate application functionality and should be tested. Additionally, train users and enforce policy against opening unsolicited WPF documents or XAML files from untrusted sources.
More in Visual Studio 2022
View allDenial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
.NET and Visual Studio Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely e
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service ove
Heap-based buffer overflow (CWE-122) in Microsoft .NET and Visual Studio allows a network-based unauthenticated attacker
Heap-based buffer overflow in Microsoft Visual Studio 2022 and 2026 enables network-delivered remote code execution when
Privilege escalation in Microsoft .NET runtimes (8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022 and 2026 results f
Heap-based buffer overflow (CWE-122) in Microsoft .NET enables local code execution across all actively supported .NET r
Local code execution via out-of-bounds write in Microsoft .NET allows an unauthenticated local attacker to achieve full
Local privilege escalation in Microsoft .NET (versions 8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022/2026 allows
Denial-of-service in Microsoft .NET runtimes and Visual Studio allows unauthenticated remote attackers to crash or hang
Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process com
Use-after-free memory corruption in Microsoft's QUIC protocol implementation (MsQuic) exposes sensitive heap memory to u
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today