EOL Fix Available | CVE-2026-62897

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

A Remote Code Execution vulnerability (CVE-2026-62897) has been identified in Windows Presentation Foundation (WPF), which allows an unauthorized attacker to execute code. Two geometry sink entry points advanced a running byte offset without first checking that the addition would fit, so a sufficiently large figure or polygon could carry the offset past the signed 32-bit maximum.

Per CWE-190: Integer Overflow or Wraparound, the product performs a calculation that can produce an integer overflow or wraparound when the logic assumes the resulting value will always be larger than the original.

This issue affects .NET 6. WPF ships as part of the Microsoft.WindowsDesktop.App shared framework and is Windows-only.

Note on identification: Microsoft's CVRF feed titles this advisory ".NET Framework Remote Code Execution Vulnerability", but the .NET advisory body identifies the affected component as Windows Presentation Foundation, listing the Microsoft.WindowsDesktop.App.Runtime.win-x64, win-x86 and win-arm64 runtime packs. Those are the RID-specific packs that carry the shared framework; the version range above is expressed against the Microsoft.WindowsDesktop.App shared framework itself, matching the rest of this release.

‍

Details

Module Info

Product: .NET
Affected packages: Windows Presentation Foundation (ships in the Microsoft.WindowsDesktop.App shared framework)
Affected versions: Microsoft.WindowsDesktop.App >= 6.0.0 <= 6.0.43
GitHub repository: https://github.com/dotnet/wpf
Published packages: Download .NET (Linux, macOS, and Windows)
Package manager: NuGet
Fixed in: NES for .NET 6.0.44

Vulnerability Info

This High-severity vulnerability is found in the GlyphRunGeometrySink implementation in WPF's native graphics layer — the same file as CVE-2026-62886, which Microsoft fixed in the same change. The two are distinct defects and are tracked separately: 62886 concerns the width of the offset and size members, while this issue concerns the absence of a headroom check before they are advanced.

The sink maintains a running byte offset as it accumulates geometry. Two entry points — the one that begins a new figure, and the one that appends a generic polygon — incremented that offset by an attacker-influenced amount without first verifying that the result would remain in range. A figure or polygon large enough to carry the offset past INT_MAX wrapped the arithmetic, after which the corrupted offset was used to position subsequent writes into the geometry buffer.

The fixed release rejects the operation up front rather than detecting the damage afterwards: both entry points now test whether the addition would carry past the representable maximum before performing it, and return a bad-number error code if it would. Failing at the point of the arithmetic — rather than validating the resulting offset later — is what makes the check complete, since a wrapped offset is indistinguishable from a legitimate small one once it has been stored.

The new checks are gated on the existing WPF graphics bounds-check switch, which defaults to protection enabled.

‍

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

Upgrade affected applications to one of:
- .NET >= 8.0.30
- .NET >= 9.0.19
- .NET >= 10.0.11
Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.44 or later.

‍