EXECUTIVE SUMMARY:
CVE-2026-70007 with a CVSS score of 8.8 is a remote code execution vulnerability affecting Microsoft.WindowsDesktop.App.Runtime.win-arm64 versions >= 11.0.0-preview.1, <= 11.0.0-rc.1 affecting Microsoft.WindowsDesktop.App.Runtime.win-x64 versions >= 11.0.0-preview.1, <= 11.0.0-rc.1 in Microsoft.WindowsDesktop.App.Runtime (WPF) that allows an attacker to desynchronize the two parsing passes in CPSTrans::Initialize, causing heap out-of-bounds writes or reads. The vulnerability affects Windows platforms and all architectures, specifically affecting.NET projects using affected package versions listed below. Affected packages include Microsoft.WindowsDesktop.App.Runtime.win-arm64 >= 9.0.0, <= 9.0.20, patched version 9.0.21; Microsoft.WindowsDesktop.App.Runtime.win-x64 >= 9.0.0, <= 9.0.20, patched version 9.0.21; and other versions listed below. The vulnerability can be exploited by an attacker via the environment template management API, requiring no privileges or user interaction. It has a high impact on confidentiality, integrity, and availability, allowing attackers to potentially execute arbitrary code.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY:
CVE-2026-70007 with a CVSS score of 8.8 is a remote code execution vulnerability affecting Microsoft.WindowsDesktop.App.Runtime.win-arm64 versions >= 11.0.0-preview.1, <= 11.0.0-rc.1 affecting Microsoft.WindowsDesktop.App.Runtime.win-x64 versions >= 11.0.0-preview.1, <= 11.0.0-rc.1 in Microsoft.WindowsDesktop.App.Runtime (WPF) that allows an attacker to desynchronize the two parsing passes in CPSTrans::Initialize, causing heap out-of-bounds writes or reads. The vulnerability affects Windows platforms and all architectures, specifically affecting.NET projects using affected package versions listed below. Affected packages include Microsoft.WindowsDesktop.App.Runtime.win-arm64 >= 9.0.0, <= 9.0.20, patched version 9.0.21; Microsoft.WindowsDesktop.App.Runtime.win-x64 >= 9.0.0, <= 9.0.20, patched version 9.0.21; and other versions listed below. The vulnerability can be exploited by an attacker via the environment template management API, requiring no privileges or user interaction. It has a high impact on confidentiality, integrity, and availability, allowing attackers to potentially execute arbitrary code.[emaillocker id="1283"]
RECOMMENDATIONS:
REFERENCES:
The following reports contain further technical details:
https://github.com/advisories/GHSA-pfwj-2f93-rf42