high · 7.8CVE-2026-50650Jul 21, 2026

CVE-2026-50650: WPF XAML Code Injection Elevation of Privilege

Shubham Kandhare
Security Engagement Manager, SecureLayer7

A specially crafted XAML file fed to a WPF application can trigger code injection that elevates the attacker's privileges on the local Windows system.

PackageMicrosoft.WindowsDesktop.App.Runtime.win-x64
Ecosystemnuget
Affected>= 10.0.0, <= 10.0.9
Fixed in10.0.10

The problem

Windows Presentation Foundation (WPF) in .NET 8, 9, and 10 does not sufficiently restrict what can be instantiated or invoked when parsing XAML input. An attacker who can cause a WPF application to parse a crafted .xaml file can inject and execute arbitrary code in the context of that process.

The vulnerability requires local access and user interaction (opening or previewing a malicious file), matching the CVSS vector AV:L/AC:L/PR:N/UI:R. Successful exploitation gives full confidentiality, integrity, and availability impact, earning a CVSS 3.1 score of 7.8 (High).

The fix

Update to the patched runtime for your .NET version: .NET 10.0.10, .NET 9.0.18, or .NET 8.0.29. Self-contained applications must be recompiled and redeployed against the patched SDK. Run dotnet --info to confirm your installed version. If you deploy WPF apps that parse user-supplied XAML, validate and restrict XAML sources as a defense-in-depth measure regardless of patch status.

Reported by bribrothers.

References: [1][2][3][4][5][6]

Related research