EOL Fix Available | CVE-2026-50646

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

A remote code execution vulnerability (CVE-2026-50646) has been identified in the XAML parser of Windows Presentation Foundation (WPF), which allows an attacker to execute arbitrary code by supplying crafted XAML that instantiates dangerous types during parsing.

Per CWE-693: Protection Mechanism Failure, the product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

This issue affects Windows Presentation Foundation (WPF) on .NET 6. WPF is Windows-only, and exploitation requires a local attack vector and user interaction — a user must open or load the crafted markup.

‍

Details

Module Info

Product: .NET (Windows Presentation Foundation)
Affected packages: Microsoft.WindowsDesktop.App.Runtime.win-x64
Affected versions: >= 6.0.0 <= 6.0.42
GitHub repository: https://github.com/dotnet/wpf
Published packages: Download .NET (Linux, macOS, and Windows)
Package manager: NuGet
Fixed in: NES for .NET 6.0.43

Vulnerability Info

This High-severity vulnerability is found in the XAML loading paths of Windows Presentation Foundation (WPF) in .NET 6. WPF provides a restrictive XAML reader precisely so that untrusted markup can be loaded safely — it refuses to construct dangerous types. That protection mechanism exists and works, but certain embedded-XAML load paths, for example ink clipboard content and TextTree undo, never opt into it and instead load attacker-controllable markup through the permissive reader. A crafted payload can therefore cause the loader to instantiate types such as ObjectDataProvider, which invoke arbitrary methods, yielding arbitrary code execution in the context of the application that parsed the markup.

CVE-2026-50646, CVE-2026-50649 and CVE-2026-50650 were reported separately and are addressed together by the same XAML restrictive-reader hardening in NES for .NET 6.0.43.

This vulnerability has been present since at least .NET (WPF) 6.0 and likely earlier.

‍

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

Upgrade affected applications to one of:
- .NET Desktop Runtime >= 8.0.29
- .NET Desktop Runtime >= 9.0.18
- .NET Desktop Runtime >= 10.0.10
Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.43 or later.

‍