CVE-2026-50650

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

An elevation of privilege vulnerability (CVE-2026-50650) has been identified in the XAML parser of Windows Presentation Foundation (WPF), which allows an attacker to run code with the privileges of the host application by supplying crafted XAML that instantiates dangerous types during parsing.

Per CWE-94: Improper Control of Generation of Code ('Code Injection'), the product constructs all or part of a code segment using externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

This issue affects Windows Presentation Foundation (WPF) on .NET 6. WPF is Windows-only, and exploitation requires a local attack vector and user interaction — a user must open or load the crafted markup.

‍

Details

Module Info

• Product: .NET (Windows Presentation Foundation)
• Affected packages: Microsoft.WindowsDesktop.App.Runtime.win-x64
• Affected versions: >= 6.0.0 <= 6.0.42
• GitHub repository: https://github.com/dotnet/wpf
• Published packages: Download .NET (Linux, macOS, and Windows)
• Package manager: NuGet
• Fixed in: NES for .NET 6.0.43

Vulnerability Info

This High-severity vulnerability is found in the XAML loading paths of Windows Presentation Foundation (WPF) in .NET 6. Certain embedded-XAML load paths do not enforce the restrictive XAML reader, so markup from an untrusted or attacker-controllable source is parsed with the permissive reader. Because XAML is itself executable markup — object graphs are instantiated and members invoked as the parser walks the document — a crafted payload can cause the loader to construct types such as ObjectDataProvider that invoke arbitrary methods. The injected markup therefore executes with the privileges of the host application, elevating the attacker's privileges to those of the process that loaded the markup.

CVE-2026-50646, CVE-2026-50649 and CVE-2026-50650 were reported separately and are addressed together by the same XAML restrictive-reader hardening in NES for .NET 6.0.43.

This vulnerability has been present since at least .NET (WPF) 6.0 and likely earlier.

‍

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to one of:
  
  • .NET Desktop Runtime >= 8.0.29
  • .NET Desktop Runtime >= 9.0.18
  • .NET Desktop Runtime >= 10.0.10
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.43 or later.

‍

Credits

Microsoft did not publicly credit an individual finder for this vulnerability in its security advisory.