CVE-2026-96229: CWE-183: Permissive List of Allowed Inputs in Microsoft .NET 10.0

This vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF) relates to a permissive list of allowed inputs (CWE-183) that could allow unsafe URI fetching and navigation. Microsoft has implemented restrictive XAML and XPS security fixes that block unsafe URI fetching and navigation, propagate untrusted-input state through hyperlink navigation, add TrueType font protection, enforce XAML nesting-depth limits, and avoid caching positive DNS zone-policy decisions. The vulnerability affects multiple versions of the runtime packages on Windows across all architectures (x86, x64, arm64). Official patches are available in versions 8.0.32, 9.0.21, 10.0.13, and 11.0.0-rc.2 and later.

The vulnerability allows unsafe URI fetching and navigation, which could lead to exposure of sensitive information (confidentiality impact). There is no impact on integrity or availability. The CVSS v3.1 score is 6.5 (medium severity), indicating a network attack vector with low attack complexity, no privileges required, but user interaction is needed.

An official fix is available. Users should update to the patched versions of Microsoft.WindowsDesktop.App.Runtime packages: 8.0.32, 9.0.21, 10.0.13, and 11.0.0-rc.2 or later. Applications referencing vulnerable packages must update their package references accordingly. Self-contained applications targeting affected versions must be recompiled and redeployed with the updated runtime. After updating, restart applications to apply the fix.