Key points
- The flaw affects .NET versions 8 through 11 on Windows.
- Patches are available for all affected version lines.
- The issue stems from deserialization of untrusted data.
Microsoft has issued security updates for the .NET Windows Presentation Foundation (WPF) runtimes to address a high-severity remote code execution vulnerability identified as CVE-2026-83520. The flaw impacts .NET versions 8, 9, 10, and 11 on Windows systems. Patches are now available for all affected version lines, allowing teams to remediate the issue immediately.
In plain English
The vulnerability arises from how the .NET runtime handles untrusted data during deserialization. An attacker can exploit this to execute arbitrary code over a network. This requires user interaction, as indicated by the CVSS vector. The fix includes stricter controls on XAML and XPS processing. These changes block unsafe URI fetching, limit nesting depth, and improve font protection.
The background
Microsoft describes the issue as a deserialization of untrusted data flaw, mapped to CWE-502. It affects the Microsoft.WindowsDesktop.App.Runtime packages across multiple architectures, including win-x64, win-x86, and win-arm64. The CVSS score is 8.8, classified as high severity. This follows similar reporting on .NET vulnerabilities, such as the out-of-bounds write flaw in versions 8 through 11 noted earlier in October 2026.
What changes now
Developers must update their applications to use the patched runtime versions. For .NET 11, the fix is in 11.0.0-rc.2. For .NET 10, it is 10.0.13. For .NET 9, it is 9.0.21. For .NET 8, it is 8.0.32. Teams should verify their NuGet package versions and upgrade accordingly. The updates apply to all Windows architectures supported by these runtimes.
Who needs to act first
Security operations teams should prioritize systems that process external or untrusted documents. Identify applications using WPF that handle user-supplied XPS or XAML files. Test the updated runtimes in a non-production environment to ensure application compatibility. Back up current configurations before deploying the changes. Roll out the updates to exposed systems first, then internal endpoints. Monitor logs for unusual activity during the transition.
What to do and how to stay safe: Microsoft
- Inventory all Windows servers and workstations running .NET 8 through 11.
- Identify applications that parse XPS or XAML files from untrusted sources.
- Apply the patched runtime versions listed in the advisory.
- Monitor network traffic for signs of exploitation attempts.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which .NET versions are affected by CVE-2026-83520?
Versions 8, 9, 10, and 11 of the .NET WPF runtime on Windows are affected.
Is there a patch available for this vulnerability?
Yes, Microsoft has released patched versions for all affected .NET lines.
What is the severity of this flaw?
It is rated high severity with a CVSS score of 8.8.
