high · 7.8CVE-2026-62871Aug 11, 2026

CVE-2026-62871: WPF .NET Desktop Runtime Heap Buffer Overflow Elevation of Privilege

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

A heap-based buffer overflow in the Windows Presentation Foundation (WPF) layer of the .NET Desktop Runtime lets a local attacker gain elevated privileges by tricking a user into opening a crafted…

PackageMicrosoft.WindowsDesktop.App.Runtime.win-arm64
Ecosystemnuget
Affected>= 10.0.0, <= 10.0.10
Fixed in10.0.11
CVE-2026-62871: WPF .NET Desktop Runtime Heap Buffer Overflow Elevation of Privilege

The problem

The vulnerability lives in native WPF code shipped with the .NET Desktop Runtime on Windows, specifically in components that process TrueType and OpenType font data.

Arithmetic on attacker-controlled values such as glyph counts, table offsets, and buffer dimensions is performed without overflow checks. The resulting integer wraps produce undersized heap allocations that are subsequently overwritten, satisfying both CWE-787 (Out-of-bounds Write) and CWE-122 (Heap-based Buffer Overflow).

Successful exploitation requires user interaction: a victim must open or render content that causes a vulnerable WPF application to subset the malicious font. The CVSS vector (AV:L/AC:L/PR:N/UI:R) reflects this local, no-privilege, user-triggered profile.

The fix

Update to .NET 10.0.11, .NET 9.0.19, or .NET 8.0.30 via your normal .NET update channel or Visual Studio prompt. Self-contained deployments must be recompiled and redeployed against the patched runtime. Confirm the installed version with dotnet --info. Applications that do not use WPF (console apps, ASP.NET Core services) are not affected and do not ship the vulnerable native components.

Reported by Ky0toFu.

References: [1][2][3][4][5]

Related research