.NET WPF Integer Overflow: MS Patches Remote Priv Escalation in Desktop Runtime 8-11

Microsoft has released security updates for the .NET Desktop Runtime to address a high-severity elevation of privilege vulnerability. The flaw, identified as CVE-2026-85363, affects Windows applications using specific versions of the Microsoft.WindowsDesktop.App.Runtime packages. According to the official advisory, an attacker can exploit this issue over a network to gain unauthorized access. The vulnerability exists in versions 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12, and preview releases of version 11.

In plain English

The problem stems from how the software handles certain graphic rendering tasks. When the system processes attacker-controlled coordinates for text glyphs, an integer overflow occurs. This error causes the software to write data outside the intended memory boundaries. According to the GitHub advisory, this out-of-bounds write can lead to process termination and allows an unauthorized user to elevate their privileges. The flaw resides in the WPF component of the runtime.

The background

Microsoft rated the vulnerability as high severity with a CVSS score of 8.8. The Common Weakness Enumeration classifies the issue as CWE-190, an integer overflow or wraparound. The attack vector is network-based, requiring no prior authentication but user interaction. The flaw impacts all Windows architectures, including ARM64, x64, and x86. The advisory notes that the issue is specific to projects using the affected package versions.

What changes now

Developers must update their applications to the patched versions to mitigate this risk. For .NET 8, the fixed version is 8.0.32. For .NET 9, users should move to version 9.0.21. .NET 10 users need to upgrade to 10.0.13. Those using .NET 11 preview releases must update to 11.0.0-rc.2. These updates apply to the Microsoft.WindowsDesktop.App.Runtime packages for all supported Windows architectures.

Who needs to act first

Security teams should prioritize updating systems that host public-facing applications using WPF components. Exposed endpoints present the highest risk because the flaw is accessible over a network. Teams usually begin by identifying which internal services rely on the affected runtime versions. It is prudent to test the updated packages in a staging environment before a full rollout. Backing up current configurations helps ensure a safe recovery if the update causes compatibility issues.

Background: Privilege escalation attacks

Monitor for unexpected process spawning from low-privilege contexts, changes to system binaries, and abnormal access to sensitive configuration files. Correlate these signals with user behavior baselines to catch lateral movement before it becomes a full compromise.

Read the full guide: Detect Privilege Escalation Attacks: Log Signals and Blind Spots

What to do and how to stay safe: Microsoft

• Audit your inventory to identify all applications using the affected .NET Desktop Runtime versions.
• Verify if any of these applications are accessible over the network or require user interaction.
• Schedule updates to the patched versions during a maintenance window to minimize disruption.
• Monitor system logs for unusual activity or process terminations while awaiting full deployment.

Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits

General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which .NET versions are affected by CVE-2026-85363?

Versions 8.0.0 to 8.0.31, 9.0.0 to 9.0.20, 10.0.0 to 10.0.12, and .NET 11 preview releases up to rc.1 are affected.

Is there a fix available for this vulnerability?

Yes, Microsoft has released patched versions: 8.0.32, 9.0.21, 10.0.13, and 11.0.0-rc.2 for the affected packages.

What is the severity of this vulnerability?

Microsoft rates the severity as high with a CVSS score of 8.8.