CVE-2026-35433

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

A vulnerability (CVE-2026-35433) exists in the native Windows Presentation Foundation (WPF) code shipped with the .NET Desktop Runtime when the TtfDelta TrueType font subsetter in the DirectWriteForwarder component processes attacker-controlled font data, such as a crafted .ttf or .otf font delivered in an XPS document or XAML content. Unchecked arithmetic on attacker-controlled table lengths, glyph counts, and offsets can wrap around, resulting in a heap-based buffer overflow. This can allow an unauthorized attacker to elevate privileges locally; an attacker who successfully exploited this vulnerability could gain SYSTEM privileges. Exploitation requires that a user trigger the payload in the application.

Per CWE-20: Improper Input Validation, Improper Input Validation is when the product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Per CWE-122: Heap-based Buffer Overflow, a Heap-based Buffer Overflow is defined as a buffer overflow condition where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

This issue affects .NET 6.0.0 <= 6.0.40 in NES-supported environments. Microsoft also serviced supported .NET releases in its May 12, 2026 security updates for .NET 8.0, .NET 9.0, and .NET 10.0. Only Windows Presentation Foundation (WPF) applications on Windows are affected; the vulnerable code ships in the .NET Desktop Runtime packages, not in the base .NET or ASP.NET Core runtimes.

Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

‍

Details

Module Info

• Product:
  
  • Any .NET 6.0 application using Windows Presentation Foundation (WPF) running on .NET 6.0.40 or earlier.
• Affected packages:
  
  • Microsoft.WindowsDesktop.App.Runtime.win-x64
  • Microsoft.WindowsDesktop.App.Runtime.win-x86
  • Microsoft.WindowsDesktop.App.Runtime.win-arm64
• Affected versions:
  
  • >= 6.0.0 <= 6.0.40
• GitHub repository: https://github.com/dotnet/wpf
• Published packages: Download .NET (Linux, macOS, and Windows)
• Package manager:
  
  • NuGet
  • Windows Installer
  • Docker
• Fixed in: NES for .NET 6.0.41

Vulnerability Info

This High-severity vulnerability is found in the native Windows Presentation Foundation (WPF) code within the .NET Desktop Runtime, notably the TtfDelta TrueType font subsetter in the DirectWriteForwarder component. The subsetter performs allocation-size and offset arithmetic on attacker-controlled values, such as font table lengths, glyph counts, and table offsets, without guarding against integer overflow or wraparound. A crafted font can wrap these calculations, producing undersized heap allocations and out-of-bounds reads and writes of heap memory. A local, unauthorized attacker who convinces a user to process malicious content in a WPF application, for example a crafted TrueType font embedded in an XPS document or XAML content that is subsetted during printing or XPS serialization, could exploit this heap-based buffer overflow to elevate privileges, and successful exploitation could gain SYSTEM privileges. Note: only applications that use WPF on Windows are affected; console or ASP.NET Core workloads running on the base .NET runtime do not include this code.

‍

Mitigation

.NET 6.x is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to one of:
  
  • .NET Desktop Runtime >= 8.0.27
  • .NET Desktop Runtime >= 9.0.16
  • .NET Desktop Runtime >= 10.0.8
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.41 or later.

‍

Credits

• Ky0toFu