CVE-2026-96235: CWE-787: Out-of-bounds Write in Microsoft .NET 10.0

This vulnerability (CVE-2026-96235) is an out-of-bounds write (CWE-787) in Microsoft.WindowsDesktop.App.Runtime (WPF) caused by crafted pixel-shader bytecode that desynchronizes two parsing passes in the CPSTrans::Initialize function. This flaw can lead to heap out-of-bounds reads or writes, potentially compromising application stability and security. It affects Windows platforms on all architectures and multiple package versions of Microsoft.WindowsDesktop.App.Runtime ranging from 8.0.0 through 11.0.0-rc.1. Microsoft has issued official patches in versions 8.0.32, 9.0.21, 10.0.13, and 11.0.0-rc.2 to address this issue. The CVSS 3.1 score is 8.8, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

The vulnerability allows an attacker to cause heap out-of-bounds writes or reads by supplying crafted pixel-shader bytecode, which can lead to memory corruption. This may result in arbitrary code execution, data corruption, or application crashes, impacting confidentiality, integrity, and availability of affected applications. The CVSS score of 8.8 reflects a high severity risk with potential for significant exploitation impact if triggered.

An official fix is available. Users and developers should update to the patched versions of Microsoft.WindowsDesktop.App.Runtime packages: 8.0.32, 9.0.21, 10.0.13, and 11.0.0-rc.2 or later. Applications referencing vulnerable packages must update their package references accordingly. Self-contained applications targeting affected versions must be recompiled and redeployed with the updated runtime. Restart applications after updating to ensure the fix takes effect.