Microsoft Patches .NET WPF Flaw Letting Attackers Execute Code Via Malicious XPS Hyperlinks on Windows

Microsoft has addressed a high-severity remote code execution vulnerability in its .NET framework, specifically within the Windows Presentation Foundation component. The flaw, tracked as CVE-2026-70174, allows unauthorized attackers to execute code over a network by exploiting improper security checks in standard implementations.

What happened

Microsoft security researchers identified a weakness in how .NET handles XPS hyperlink navigation within Windows Presentation Foundation applications. According to the GitHub advisory GHSA-f749-vhgx-39h6, this improper implementation allows navigation to bypass intended URI restrictions. An attacker can craft a document that directs the application to an attacker-controlled ObjectDataProvider. This bypass enables remote code execution, but it requires user interaction to trigger the malicious navigation path. The issue stems from CWE-358, which describes an improperly implemented security check for a standard.

The vulnerability impacts a wide range of .NET versions deployed on Windows systems. Affected versions include .NET 8.0, 9.0, 10.0, and early preview builds of 11.0. Specifically, any runtime version from 8.0.0 up to 8.0.31 is vulnerable, as are versions from 9.0.0 up to 9.0.20. The flaw extends to .NET 10.0 releases up to 10.0.12 and preview releases of 11.0 up to 11.0.0-rc.1. Microsoft has assigned the flaw a CVSS score of 8.8, classifying it as high severity.

Why it matters

Security operations teams must recognize that this flaw targets the Windows Desktop App Runtime across all supported architectures, including x64, x86, and arm64. Because the exploit requires user interaction, it likely relies on social engineering to get users to open or view malicious XPS documents. This mirrors other recent supply chain and component-level risks, such as the D-Link firmware tampering issue Firewall Chronicle reported in October 2026, where improper verification allowed remote manipulation. In this case, the improper verification of URI destinations allows code execution.

Developers using .NET 8.0, 9.0, or 10.0 in production environments are immediately exposed if they have not updated to the latest patch levels. The patched versions are 8.0.32, 9.0.21, and 10.0.13 respectively. For those running preview versions of .NET 11.0, the fix is available in version 11.0.0-rc.2. Failure to update leaves applications vulnerable to remote code execution attacks that could compromise the entire host system.

What to watch

• Monitor for unexpected process spawns originating from WPF-based applications.
• Look for outbound network connections from desktop apps that do not typically access the internet.
• Check for the presence of XPS documents in user directories that were not expected or authorized.
• Verify that all .NET runtime packages are updated to the patched versions listed in the advisory.

Signals worth monitoring

Teams usually detect this type of activity by reviewing application logs for unusual navigation events or failed security checks within WPF components. Defenders should check whether endpoint detection tools flag attempts to instantiate ObjectDataProvider from unexpected sources. Look for anomalous process creation chains where a document viewer spawns a command shell or script engine. Containment moves typically involve isolating affected endpoints and blocking access to known malicious document sources while verifying runtime versions.

Background: Social engineering

Social engineering manipulates psychological triggers like urgency and authority to compel victims into bypassing security protocols. It succeeds not because of technical flaws, but because humans are wired to trust familiar patterns and helpful colleagues. Defending against it requires verifying identity through out-of-band channels and treating unexpected requests as suspicious regardless of their source.

Read the full guide: Social Engineering: How Manipulation Bypasses Technical Defenses

What to do and how to stay safe: Microsoft

• Audit all internal applications to identify those using vulnerable versions of Microsoft.WindowsDesktop.App.Runtime.
• Update affected .NET runtimes to the specific patched versions: 8.0.32, 9.0.21, 10.0.13, or 11.0.0-rc.2.
• Implement application whitelisting to restrict which processes can execute code from user directories.
• Educate users on the risks of opening unsolicited XPS or similar document files from unknown sources.

General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which .NET versions are affected by CVE-2026-70174?

Versions 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12, and preview versions of 11.0 up to 11.0.0-rc.1 are affected.

Is a patch available for this vulnerability?

Yes, Microsoft has released patched versions including 8.0.32, 9.0.21, 10.0.13, and 11.0.0-rc.2 for all affected platforms.

Does this vulnerability require user interaction?

Yes, the CVSS vector indicates that user interaction is required for the remote code execution to occur.