CVE-2026-50649

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

A remote code execution vulnerability (CVE-2026-50649) has been identified in the XAML parser of Windows Presentation Foundation (WPF), which allows an attacker to execute arbitrary code by supplying crafted XAML that instantiates dangerous types during parsing.

Per CWE-502: Deserialization of Untrusted Data, the product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

This issue affects Windows Presentation Foundation (WPF) on .NET 6. WPF is Windows-only, and exploitation requires a local attack vector and user interaction — a user must open or load the crafted markup.

‍

Details

Module Info

• Product: .NET (Windows Presentation Foundation)
• Affected packages: Microsoft.WindowsDesktop.App.Runtime.win-x64
• Affected versions: >= 6.0.0 <= 6.0.42
• GitHub repository: https://github.com/dotnet/wpf
• Published packages: Download .NET (Linux, macOS, and Windows)
• Package manager: NuGet
• Fixed in: NES for .NET 6.0.43

Vulnerability Info

This High-severity vulnerability is found in the XAML loading paths of Windows Presentation Foundation (WPF) in .NET 6. Certain embedded-XAML load paths do not enforce the restrictive XAML reader, so markup from an untrusted or attacker-controllable source is deserialized with the permissive reader. Loading XAML reconstructs an object graph described entirely by the markup — the parser instantiates the types the document names and sets the members it specifies — so an attacker who controls the document controls what gets constructed. A crafted payload can name types such as ObjectDataProvider, which invokes arbitrary methods on the objects it creates, yielding arbitrary code execution in the context of the application that loaded the markup.

CVE-2026-50646, CVE-2026-50649 and CVE-2026-50650 were reported separately and are addressed together by the same XAML restrictive-reader hardening in NES for .NET 6.0.43.

This vulnerability has been present since at least .NET (WPF) 6.0 and likely earlier.

‍

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to one of:
  
  • .NET Desktop Runtime >= 8.0.29
  • .NET Desktop Runtime >= 9.0.18
  • .NET Desktop Runtime >= 10.0.10
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.43 or later.

‍

Credits

Microsoft credits Kevin Gosse for reporting this vulnerability.