Microsoft .NET WPF RCE Flaw CVE-2026-70174 Patches XPS Link Bypass

Microsoft has released security updates for its .NET Windows Presentation Foundation (WPF) runtimes to address a high-severity remote code execution vulnerability identified as CVE-2026-70174. The flaw affects .NET versions 8.0 through 11.0 preview releases on all Windows architectures. According to the GitHub advisory, the issue stems from an improperly implemented security check that allows XPS hyperlink navigation to bypass URI restrictions. This bypass enables an attacker to reach an attacker-controlled ObjectDataProvider, resulting in code execution after user interaction.

In plain English

The vulnerability exists in how .NET WPF handles links within XPS documents. When a user clicks a hyperlink in an XPS file, the application should restrict where that link can lead. However, the security check failed to enforce these restrictions properly. An attacker can craft a malicious XPS file with a hyperlink that redirects to a dangerous data provider. If a user opens the file and clicks the link, the application executes arbitrary code on their machine. This requires user interaction but no prior authentication.

The background

Microsoft classifies CVE-2026-70174 as a high-severity issue with a CVSS score of 8.8. The weakness is categorized under CWE-358, which covers improperly implemented security checks for standards. The advisory notes that this affects projects using specific Microsoft.WindowsDesktop.App.Runtime packages. Previous vulnerabilities, such as the Adobe ColdFusion authorization flaw reported by Vuln Post in October 2026, also allowed remote code execution, highlighting the persistent risk in desktop application frameworks.

What changes now

Developers and system administrators must update their .NET WPF runtimes to the patched versions. For .NET 8.0, the fix is available in version 8.0.32. For .NET 9.0, users should update to 9.0.21. .NET 10.0 users need version 10.0.13, while those on the .NET 11.0 preview track must move to 11.0.0-rc.2. These updates apply to win-arm64, win-x64, and win-x86 architectures. Applications built with older runtime versions remain vulnerable until updated.

Who needs to act first

Security teams should prioritize updating systems that host or process XPS files from untrusted sources. Organizations should identify servers and workstations running vulnerable .NET versions and apply the patches during the next maintenance window. Before rolling out updates, test the patched runtimes in a non-production environment to ensure application compatibility. If immediate patching is not feasible, restrict user access to external XPS files and monitor for unusual process spawns that may indicate exploitation attempts.

What to do and how to stay safe: Microsoft

• Inventory all systems running .NET WPF applications to identify those using vulnerable runtime versions.
• Apply the latest available patches for .NET 8, 9, 10, and 11 preview releases to affected machines.
• Educate users to avoid opening XPS files from unknown or untrusted email attachments.
• Monitor application logs for unexpected execution events or access to restricted data providers.

Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits

General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does this vulnerability require user interaction?

Yes, the advisory states that remote code execution occurs after user interaction with the malicious XPS hyperlink.

Which .NET versions are affected by CVE-2026-70174?

Versions 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12, and 11.0.0-preview.1 through 11.0.0-rc.1 are affected.

Is there a patch available for this flaw?

Yes, Microsoft has released patched versions including 8.0.32, 9.0.21, 10.0.13, and 11.0.0-rc.2 for all affected architectures.