Enterprises urged to patch .NET 8-11 Preview to stop remote code execution via deserialization flaw CVE-2026-70035

Microsoft has released patches for a high-severity vulnerability in its .NET Framework that could allow attackers to run malicious code on Windows systems. The flaw, tracked as CVE-2026-70035, stems from how the software handles untrusted data during a process called deserialization. According to the official advisory, an unauthorized attacker could exploit this weakness over a network to execute code without needing prior authentication, though user interaction is required.

The issue impacts Microsoft.WindowsDesktop.App.Runtime packages, which include Windows Presentation Foundation (WPF) components. It affects versions 8, 9, 10 and the preview releases of version 11 across all Windows architectures. Developers and IT teams must update their applications to remove this vulnerability. The patches address restrictive XAML and XPS security fixes, including blocks on unsafe URI fetching and navigation.

What we know

The vulnerability is rated as high severity with a CVSS score of 8.8, according to the GitHub advisory GHSA-4j9v-h7pp-725h. It is classified under CWE-502, which covers the deserialization of untrusted data. The flaw allows an attacker to execute code remotely if the victim interacts with the malicious content. This means the attack is not fully automatic; some form of user engagement is necessary for the exploit to succeed.

Affected packages include Microsoft.WindowsDesktop.App.Runtime for Windows ARM64, x64 and x86 systems. For .NET 10, versions from 10.0.0 up to 10.0.12 are vulnerable, with 10.0.13 providing the fix. In .NET 9, versions 9.0.0 through 9.0.20 are at risk, patched in 9.0.21. For .NET 8, the vulnerable range is 8.0.0 to 8.0.31, with the patch available in version 8.0.32.

Preview users of .NET 11 are also affected. Versions 11.0.0-preview.1 through 11.0.0-rc.1 contain the flaw. The patched version is 11.0.0-rc.2. Microsoft states that the security fixes also add TrueType font protection and XAML nesting-depth limits. These changes aim to avoid caching positive DNS zone-policy decisions and propagate untrusted-input state through hyperlink navigation.

As TechWire Beat reported on 2026-10-13, researchers have previously chained flaws in Windows components to bypass security protections. While that incident involved SFAPE.dll and Virtualisation Based Security, it highlights the ongoing risk of complex attack chains in the Windows ecosystem. This new .NET flaw adds another layer of risk for organisations relying on desktop applications.

Defender's checklist

• Check inventory for applications using .NET 8, 9, 10 or 11 preview runtimes.
• Verify current versions against the vulnerable ranges listed in the advisory.
• Plan updates to patched versions 8.0.32, 9.0.21, 10.0.13 or 11.0.0-rc.2.
• Monitor for any signs of unauthorised code execution or unusual network activity.

The background in plain language

Deserialization is how software turns saved data back into active objects. If the system trusts any data it receives, attackers can send crafted data that runs malicious code. This is why validating input is crucial. Teams usually restrict what data can be processed or use allowlists. Check whether your applications handle external files or network data without strict validation. This helps prevent attackers from injecting harmful commands into your system.

What to do and how to stay safe: Microsoft

• Update all .NET desktop runtime packages to the latest patched versions immediately.
• Audit internal applications to identify those using vulnerable WPF components.
• Restrict user access to untrusted files or links that could trigger the flaw.
• Monitor system logs for suspicious activities that may indicate an exploit attempt.

Step-by-step guide: Virtual Patching: Benefits, Limits and When to Use It

General security guidance from the TechWire Beat newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which .NET versions are affected by CVE-2026-70035?

Versions 8, 9, 10 and the preview releases of 11 are affected, specifically those below the patched versions listed.

Is this vulnerability critical or high severity?

It is rated as high severity with a CVSS score of 8.8, according to the GitHub advisory.

Does the attack require user interaction?

Yes, the CVSS vector indicates that user interaction is required for the exploit to succeed.