EXECUTIVE SUMMARY:
CVE-2026-96224 with a CVSS score of 8.8 is a high-severity remote code execution vulnerability affecting Microsoft.WindowsDesktop.App.Runtime and Microsoft .NET projects using vulnerable packages. The flaw allows an attacker to desynchronize the two parsing passes in CPSTrans::Initialize and cause heap out-of-bounds writes or reads. This can be exploited through crafted WPF pixel-shader bytecode, potentially leading to business disruption and data loss. The vulnerability affects Windows platforms across ARM64, x64, and x86 architectures.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY:
CVE-2026-96224 with a CVSS score of 8.8 is a high-severity remote code execution vulnerability affecting Microsoft.WindowsDesktop.App.Runtime and Microsoft .NET projects using vulnerable packages. The flaw allows an attacker to desynchronize the two parsing passes in CPSTrans::Initialize and cause heap out-of-bounds writes or reads. This can be exploited through crafted WPF pixel-shader bytecode, potentially leading to business disruption and data loss. The vulnerability affects Windows platforms across ARM64, x64, and x86 architectures.[emaillocker id="1283"]
RECOMMENDATIONS:
REFERENCES:
The following reports contain further technical details:
https://github.com/advisories/GHSA-xq57-crx4-g373