CVE-2026-96235 with a CVSS score of 8.8 is a remote code execution vulnerability in the Windows Desktop App Runtime WPF component, specifically affecting Microsoft.WindowsDesktop.App.Runtime.win-arm64, Microsoft.WindowsDesktop.App.Runtime.win-x64, and Microsoft.WindowsDesktop.App.Runtime.win-x86 packages. The flaw is an out-of-bounds write caused by crafted WPF pixel-shader bytecode that can desynchronize the two parsing passes in CPSTrans::Initialize, leading to heap out-of-bounds writes or reads. The attack vector is network-based with low complexity and no privileges required, but user interaction is necessary, meaning an attacker must persuade a user to process malicious shader content. The affected packages are Windows-specific runtime packages, and the issue can also impact self-contained applications targeting the vulnerable runtime. Because the weakness occurs during shader bytecode parsing, applications that process attacker-controlled WPF content are at risk. Successful exploitation could compromise the confidentiality, integrity, and availability of affected Windows applications, potentially enabling arbitrary code execution, data theft, service disruption, and unauthorized control of business systems.
The following reports contain further technical details:[/subscribe_to_unlock_form]
CVE-2026-96235 with a CVSS score of 8.8 is a remote code execution vulnerability in the Windows Desktop App Runtime WPF component, specifically affecting Microsoft.WindowsDesktop.App.Runtime.win-arm64, Microsoft.WindowsDesktop.App.Runtime.win-x64, and Microsoft.WindowsDesktop.App.Runtime.win-x86 packages. The flaw is an out-of-bounds write caused by crafted WPF pixel-shader bytecode that can desynchronize the two parsing passes in CPSTrans::Initialize, leading to heap out-of-bounds writes or reads. The attack vector is network-based with low complexity and no privileges required, but user interaction is necessary, meaning an attacker must persuade a user to process malicious shader content. The affected packages are Windows-specific runtime packages, and the issue can also impact self-contained applications targeting the vulnerable runtime. Because the weakness occurs during shader bytecode parsing, applications that process attacker-controlled WPF content are at risk. Successful exploitation could compromise the confidentiality, integrity, and availability of affected Windows applications, potentially enabling arbitrary code execution, data theft, service disruption, and unauthorized control of business systems.
The following reports contain further technical details:[emaillocker id="1283"]
[/emaillocker]