CVE-2026-62897: .NET WPF Integer Overflow Remote Code Execution
A crafted font or document fed to a WPF application can trigger an integer overflow in the Windows Presentation Foundation native runtime, letting an attacker run arbitrary code on the victim's…
The problem
Windows Presentation Foundation ships a native font-subsetting component (DirectWriteForwarder / TtfDelta) that performs allocation-size arithmetic on attacker-controlled values pulled from font tables, such as glyph counts, table lengths, and offsets.
Because the arithmetic is unchecked, a crafted TrueType font embedded in an XPS document or XAML content can wrap a 32-bit integer to zero or a small number, causing the runtime to allocate an undersized heap buffer and then write far beyond it. A local, unprivileged attacker who tricks a user into opening malicious content through a WPF application can achieve arbitrary code execution in the context of that user.
Only the Windows Desktop Runtime is affected; base .NET and ASP.NET Core workloads do not include this code.
The fix
Update to a patched .NET Desktop Runtime: 10.0.11, 9.0.19, or 8.0.30. Run dotnet --info to confirm the installed version. Restart affected applications after updating. Self-contained WPF deployments must be recompiled against a patched SDK and redeployed. There is no known workaround short of avoiding untrusted XPS documents and XAML content in WPF applications.
Related research
- high · 7.8CVE-2026-62886CVE-2026-62886: WPF TrueType Font Subsetter Integer Overflow Elevation of Privilege
- high · 7.8CVE-2026-62871CVE-2026-62871: WPF .NET Desktop Runtime Heap Buffer Overflow Elevation of Privilege
- high · 7.8CVE-2026-70354CVE-2026-70354: .NET WPF Out-of-Bounds Write Remote Code Execution
- highCVE-2026-48502CVE-2026-48502: MessagePack-CSharp ReadDateTime Stack Overflow via Oversized Extension Length