GHSA-4J9V-H7PP-725H Microsoft Security Advisory CVE-2026-70035 - .NET and Visual Studio Remote Code Execution Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime WPF. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Restrictive XAML and...

GHSA-4W5F-7JP2-W48G Microsoft Security Advisory CVE-2026-83520 - .NET and Visual Studio Remote Code Execution Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime WPF. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Restrictive XAML and...

GHSA-F8QH-MQG4-9939 Microsoft Security Advisory CVE-2026-96232 - .NET and Visual Studio Information Disclosure Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime WPF. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Restrictive XAML and...

GHSA-FQ6X-PVR9-888R Microsoft Security Advisory CVE-2026-96234 - .NET and Visual Studio Information Disclosure Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime WPF. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Restrictive XAML and...

GHSA-5QR9-XXM9-6CMQ Microsoft Security Advisory CVE-2026-96229 - .NET and Visual Studio Information Disclosure Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime WPF. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Restrictive XAML and...

Remote Code Execution (RCE)

Microsoft.WindowsDesktop.App.Runtime is vulnerable to remote code execution. The vulnerability is due to parsing maliciously crafted xps files, as the library does not properly implement the allow-list of legal types when calling the read method, allowing an attacker to instantiate unexpected typ...