EOL Fix Available | CVE-2026-62871

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

An Elevation of Privilege vulnerability (CVE-2026-62871) has been identified in Windows Presentation Foundation (WPF), which allows an unauthorized attacker to elevate privileges locally. A crafted TrueType font can drive several unsigned 16-bit loop counters in the font subsetter past their last valid index, wrapping the increment back to zero and writing outside the allocated buffer.

Per CWE-787: Out-of-bounds Write, the product writes data past the end, or before the beginning, of the intended buffer. In this case the write lands on the heap, matching CWE-122: Heap-based Buffer Overflow.

This issue affects .NET 6. WPF ships as part of the Microsoft.WindowsDesktop.App shared framework and is Windows-only. The subsetter runs whenever a document embeds or subsets a font, so applications that open, render or print untrusted documents should be treated as reachable.

‍

Details

Module Info

Product: .NET
Affected packages: Windows Presentation Foundation (ships in the Microsoft.WindowsDesktop.App shared framework)
Affected versions: Microsoft.WindowsDesktop.App >= 6.0.0 <= 6.0.43
GitHub repository: https://github.com/dotnet/wpf
Published packages: Download .NET (Linux, macOS, and Windows)
Package manager: NuGet
Fixed in: NES for .NET 6.0.44

Vulnerability Info

This High-severity vulnerability is found in WPF's native TrueType subsetting code, which rewrites font tables when a font is embedded in or extracted from a document. Several table walks in that code use uint16 counters that are incremented without first checking headroom against the table's real extent.

A hostile font supplies counts and offsets that push those counters past the last valid index. Because the counter is only 16 bits wide, the increment wraps to zero rather than growing, so the loop's bound test still succeeds and iteration continues with an index that no longer corresponds to the buffer it is writing into. The result is a heap out-of-bounds write whose offset the attacker influences through the font's own table metadata.

The fixed release introduces a family of overflow guards covering the wraparound sites across the character-map, glyph, embedded-bitmap, delta and table-rewriting units, together with explicit length validation on two paths that reach the same overflow indirectly — the kerning table's pair and subtable counts, and the hdmx device-record count.

The guards are placed behind their own AppContext switch, deliberately separate from the pre-existing DirectWrite bounds-check switch so that either protection can be disabled independently:

Switch.MS.Internal.TtfDelta.DisableCmapAndSbitOverflowProtection

When the switch is absent or false — the default — the protection is on. Note that this is an opt-out, not an opt-in: no configuration change is required to be protected, but setting this switch to true reintroduces the vulnerability.

‍

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

Upgrade affected applications to one of:
- .NET >= 8.0.30
- .NET >= 9.0.19
- .NET >= 10.0.11
Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.44 or later.

‍