CVE-2026-32177

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

A vulnerability (CVE-2026-32177) exists in the native code of Windows Presentation Foundation (WPF) shipped with the .NET Desktop Runtime on Windows, most prominently the DirectWriteForwarder TrueType font subsetter, along with the PenImc tablet-input and WpfGfx rendering components, due to unchecked arithmetic on attacker-controlled values such as font table glyph counts and offsets. These calculations can wrap around and produce undersized heap buffers that are subsequently overrun. This can allow a local, unauthorized attacker to elevate privileges when a user triggers processing of crafted content, such as a malicious TrueType or OpenType font embedded in an XPS document or XAML content, in an affected WPF application.

Per CWE-122: Heap-based Buffer Overflow, a Heap-based Buffer Overflow is defined as a buffer overflow condition where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Per CWE-20: Improper Input Validation, Improper Input Validation is when the product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

This issue affects .NET 6.0.0 <= 6.0.40 in NES-supported environments. Microsoft also serviced supported .NET releases in its May 12, 2026 security updates for .NET 8.0, .NET 9.0, and .NET 10.0.

Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

‍

Details

Module Info

• Product: .NET Desktop Runtime / Windows Presentation Foundation (WPF)
• Affected packages: Microsoft.WindowsDesktop.App.Runtime.win-x64, Microsoft.WindowsDesktop.App.Runtime.win-x86, and Microsoft.WindowsDesktop.App.Runtime.win-arm64 (the Windows Desktop runtime packs; Windows only, all architectures)
• Affected versions: >= 6.0.0 <= 6.0.40
• GitHub repository: https://github.com/dotnet/wpf
• Published packages: Download .NET (Linux, macOS, and Windows)
• Package manager: NuGet, Windows Installer, Docker
• Fixed in: NES for .NET 6.0.41

Vulnerability Info

This High-severity vulnerability is found in the native Windows Presentation Foundation (WPF) components shipped with the Microsoft.WindowsDesktop.App runtime on Windows, most prominently the TtfDelta TrueType font subsetter in the DirectWriteForwarder component, along with the PenImc tablet-input and WpfGfx rendering components. These components perform allocation-size and offset arithmetic on attacker-controlled values, such as font table lengths, glyph counts, and offsets, without overflow checks. In the font subsetter, a glyph count taken from a font's GSUB coverage table flows directly into an allocation:

// automap.cpp — attacker-controlled usCount, unchecked uint16 multiplication
pGlyphIDArray = (uint16 *)Mem_Alloc(usCount * sizeof(uint16));

The multiplication can wrap around, producing an undersized heap buffer that subsequent reads and writes then run past, corrupting adjacent heap memory. The vulnerable path is reached when a WPF application processes a crafted TrueType or OpenType font (.ttf or .otf) embedded in an XPS document or XAML content — for example, when a user opens or prints such a document and the font is subsetted. Exploitation requires that a user trigger the payload in the application; an attacker who successfully exploits this vulnerability could gain elevated privileges, view sensitive information, modify content, and possibly cause a crash. The same unchecked-arithmetic pattern was hardened in the PenImc tablet and stylus input layer, where packet-buffer sizing and COM-returned cursor and button counts were computed without overflow checks, and in the WpfGfx rendering pipeline, where glyph alpha-map, gradient texture, and bitmap color-source dimensions could wrap; Microsoft has not published separate reproduction details for those paths.

Only WPF workloads on Windows are exposed; console and ASP.NET Core applications running on the base .NET runtime do not include this code. The vulnerable arithmetic has been present since the WPF sources were first published in 2019 and descends from .NET Framework-era code, so every Windows Desktop runtime release from .NET Core 3.0 onward is affected.

‍

Mitigation

.NET 6.x is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to one of:
  
  • .NET Desktop Runtime >= 8.0.27
  • .NET Desktop Runtime >= 9.0.16
  • .NET Desktop Runtime >= 10.0.8
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.41 or later.

‍

Credits

Microsoft credited Ky0toFu with reporting this vulnerability.