4 .NET Versions Patched: WPF Deserialization Flaw Enables Network Code Execution

Microsoft has addressed a high-severity remote code execution vulnerability in its .NET framework, specifically within the Windows Presentation Foundation (WPF) runtimes. The flaw, tracked as CVE-2026-83520, allows attackers to execute code over a network by deserializing untrusted data. This issue impacts applications running on Windows systems that utilize affected versions of the Microsoft.WindowsDesktop.App.Runtime packages.

The vulnerability stems from how the framework handles XAML and XPS security mechanisms. According to the GitHub advisory GHSA-4w5f-7jp2-w48g, the flaw enables unsafe URI fetching and navigation. Microsoft’s update introduces restrictive XAML and XPS security fixes that block these unsafe actions. The patches also propagate untrusted-input states through hyperlink navigation and add limits to XAML nesting depth to prevent exploitation.

Technical scope and remediation

The issue affects four major version lines of the .NET runtime on Windows. Developers using .NET 8 must update to version 8.0.32 or later. For .NET 9 environments, version 9.0.21 or higher is required. Users of .NET 10 should move to version 10.0.13. Those testing the preview branch of .NET 11 need to upgrade from versions below 11.0.0-rc.1 to the patched release 11.0.0-rc.2.

Affected platforms and architectures

The vulnerability impacts all Windows architectures, including x86, x64, and ARM64. The affected packages are Microsoft.WindowsDesktop.App.Runtime for each of these platforms. The Common Weakness Enumeration classifies this as CWE-502, deserialization of untrusted data. The CVSS 3.1 vector indicates network exploitation with low complexity and no privileges required, though user interaction is needed.

Defender's checklist

Organizations should verify their current .NET runtime versions against the patched list provided by Microsoft. Security teams must ensure that all internal applications using WPF are updated to the latest stable releases. Monitoring for unusual outbound network connections can help detect attempts to exploit the unsafe URI fetching mechanism before full remediation is complete.

Operational impact

Operations teams should assess which internal tools rely on .NET WPF runtimes to determine exposure. Procurement and supplier management groups need to confirm that third-party vendors have updated their software dependencies. Communication plans should inform users about the necessity of keeping development environments patched. Leadership must understand that delayed updates could allow attackers to execute code on critical workstations, disrupting business continuity.

What to do and how to stay safe: Microsoft

• Audit your inventory to identify all systems running affected .NET versions 8, 9, 10, or 11 previews.
• Apply the latest Microsoft WindowsDesktop.App.Runtime packages as soon as they become available.
• Review application logs for signs of unauthorized URI fetching or unexpected navigation attempts.
• Train developers to avoid deserializing untrusted data without strict validation in future builds.

Step-by-step guide: Patch Management vs Vulnerability Management: The Critical Distinction

General security guidance from the InfoSec Ledger newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which .NET versions are affected by CVE-2026-83520?

The vulnerability affects .NET versions 8, 9, 10, and the preview branch of version 11 on Windows.

Is there a patch available for this vulnerability?

Yes, Microsoft has released patched versions for all affected .NET runtime branches, including 8.0.32 and 11.0.0-rc.2.

What is the severity rating of this flaw?

The flaw has a CVSS score of 8.8, which is rated as high severity.