This vulnerability affects the Windows Presentation Foundation (WPF) component of .NET versions 8, 9, and 10. It arises from improper handling of specially crafted XAML input, enabling an attacker to execute arbitrary code with the privileges of the current user. The attack vector is local (AV:L), requires low attack complexity (AC:L), no privileges (PR:N), but requires user interaction (UI:R). The scope is unchanged (S:U), and the impact on confidentiality, integrity, and availability is high (C:H/I:H/A:H). No known exploits in the wild or patch information are currently available.

Exploitation of this vulnerability could lead to full compromise of the affected system under the context of the current user, including unauthorized disclosure, modification, or destruction of data and disruption of system availability. The attack requires local access and user interaction, limiting remote exploitation possibilities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid opening untrusted XAML files and limit local user access to trusted individuals. Monitor vendor communications for updates regarding patches or workarounds.