EOL Fix Available | CVE-2026-62886

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

An Elevation of Privilege vulnerability (CVE-2026-62886) has been identified in Windows Presentation Foundation (WPF), which allows an unauthorized attacker to elevate privileges locally. Geometry generated from a sufficiently large glyph run could overflow signed 32-bit offset arithmetic, and the wrapped negative value was then written into unsigned fields of a heap geometry structure, producing an out-of-bounds write.

Per CWE-190: Integer Overflow or Wraparound, the product performs a calculation that can produce an integer overflow or wraparound when the logic assumes the resulting value will always be larger than the original. This weakness leads to CWE-122: Heap-based Buffer Overflow, where the overflowed value is used to size or index a heap allocation.

This issue affects .NET 6. WPF ships as part of the Microsoft.WindowsDesktop.App shared framework and is Windows-only; applications on Linux and macOS are not exposed. Rendering text is a routine operation, so any application that displays attacker-influenced text or documents should be treated as reachable.

‍

Details

Module Info

Product: .NET
Affected packages: Windows Presentation Foundation (ships in the Microsoft.WindowsDesktop.App shared framework)
Affected versions: Microsoft.WindowsDesktop.App >= 6.0.0 <= 6.0.43
GitHub repository: https://github.com/dotnet/wpf
Published packages: Download .NET (Linux, macOS, and Windows)
Package manager: NuGet
Fixed in: NES for .NET 6.0.44

Vulnerability Info

This High-severity vulnerability is found in the GlyphRunGeometrySink implementation in WPF's native graphics layer. The sink accumulates geometry as it walks a glyph run, tracking a running byte offset and the sizes of the figures and segments it has emitted. Those members were declared as signed int.

A glyph run large enough to push the running offset past INT_MAX wrapped it to a negative value. Nothing rejected the negative result; it was stored directly into the DWORD and UINT fields of the on-disk geometry header, where it reappeared as a very large unsigned quantity. Downstream code sized and indexed the heap buffer from those fields, so the mismatch became a heap out-of-bounds write with attacker-influenced extent — the primitive that makes this an elevation of privilege rather than a crash.

The fixed release widens the offset and size members to size_t so the arithmetic can no longer wrap at 32 bits, and makes every narrowing store into the geometry structures an explicit cast, so truncation is deliberate and confined to points that have already been range-checked.

A second, easily-missed consequence came with that change. The members previously used -1 as a "not started" sentinel, which is not representable once they are unsigned. The sentinel becomes SIZE_MAX, and every comparison against it — in SetSegmentFlags, BeginFigure, EndFigure, AddGenericPoly and EndSegment — was updated to match. Missing any one of those would have silently disabled a state check rather than producing a visible failure.

The new bounds checks are gated on the existing WPF graphics bounds-check switch, which defaults to protection enabled.

‍

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

Upgrade affected applications to one of:
- .NET >= 8.0.30
- .NET >= 9.0.19
- .NET >= 10.0.11
Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.44 or later.

‍