high · 7.8CVE-2026-62886Aug 11, 2026

CVE-2026-62886: WPF TrueType Font Subsetter Integer Overflow Elevation of Privilege

Shubham Kandhare
Security Engagement Manager, SecureLayer7

A crafted TrueType font embedded in an XPS document or XAML content can trigger an integer wraparound in WPF's native font subsetter, causing a heap buffer overflow that lets a local attacker gain…

PackageMicrosoft.WindowsDesktop.App.Runtime.win-arm64
Ecosystemnuget
Affected>= 10.0.0, <= 10.0.10
Fixed in10.0.11
CVE-2026-62886: WPF TrueType Font Subsetter Integer Overflow Elevation of Privilege

The problem

The vulnerability lives in the TtfDelta TrueType font subsetter inside DirectWriteForwarder.dll, a native C++ component shipped with the .NET Desktop Runtime on Windows.

When WPF subsets a font for printing or XPS serialization, the subsetter computes allocation sizes and buffer offsets using attacker-controlled values from the font file: table lengths, glyph counts, and table offsets. None of these arithmetic operations are guarded against integer overflow.

A crafted font can make the computed size wrap to a small value, causing malloc to return an undersized buffer. Subsequent writes into that buffer overflow the heap, giving an attacker arbitrary write primitives and a path to SYSTEM-level privilege escalation.

User interaction is required: a victim must open or print a document containing the malicious font.

Proof of concept

A working proof-of-concept for CVE-2026-62886 in Microsoft.WindowsDesktop.App.Runtime.win-arm64, with the exact payload below.

bash
# Crafted TrueType font file (.ttf) that triggers the integer wraparound.
# Derived from patch analysis (GHSA-jqhp-238x-qhgf): no public PoC binary is available.
#
# The attack primitive: set font table fields so that the subsetter's
# allocation-size arithmetic overflows to a small number.
#
# Relevant font table header fields to manipulate (Big-Endian 16/32-bit):
#   numGlyphs  (maxp table, offset 0x04) = 0xFFFF   # max glyph count -> wraps size calc
#   length     (table record)            = 0xFFFFFFFF # oversize table length -> wraps
#   offset     (table record)            = 0x00000001 # near-zero offset
#
# Embedding vector: place the crafted .ttf inside an XPS package:
#   /Resources/Fonts/evil.ttf  (referenced from a FixedPage XAML via FontUri)
# OR reference it directly in a WPF XAML resource dictionary:
#   <FontFamily>./evil.ttf#FamilyName</FontFamily>
#
# When WPF prints or serializes to XPS, TtfDelta subsets the font.
# The wrapped allocation size (e.g., 0xFFFF * recordSize + small_const overflows
# 32-bit -> tiny heap alloc) is followed by a full-size memcpy, overflowing heap.
#
# Public PoC: not yet available. Payload derived from advisory + patch diff analysis only.

The root cause is CWE-190 (Integer Overflow or Wraparound) feeding directly into CWE-122 (Heap-based Buffer Overflow). The subsetter multiplies attacker-controlled glyph counts and table lengths to compute heap allocation sizes without checking for overflow, so a maximally-sized field (e.g., numGlyphs = 0xFFFF) wraps the 32-bit product to a small number.

The resulting undersized buffer is then written into with data proportional to the original, untruncated count, producing an out-of-bounds heap write.

The patch (10.0.11 / 9.0.19 / 8.0.30) adds overflow-safe arithmetic checks before every allocation in the TtfDelta subsetter, rejecting any font whose table length, glyph count, or computed size would exceed a safe bound. The CVSS vector (AV:L/AC:L/PR:N/UI:R) reflects that no privileges are needed but a user must interact, for example by opening or printing a document with the embedded font.

The fix

Update to .NET 10.0.11, .NET 9.0.19, or .NET 8.0.30. Run dotnet --info to confirm the installed runtime version. Self-contained applications must be recompiled and redeployed against the patched SDK. Restart any running WPF applications after updating. If immediate patching is not possible, restrict processing of untrusted XPS documents or XAML content that references external fonts.

Reported by zpbrent, kai63001, Ky0toFu.

References: [1][2][3][4][5]

Related research