CVE-2026-62902

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

An Information Disclosure vulnerability (CVE-2026-62902) has been identified in Windows Presentation Foundation (WPF), which allows an unauthorized attacker to disclose information over a network. Opening a crafted XPS document could cause WPF to fetch resources from outside the document's own package, and to attach the user's default Windows credentials to those requests.

Per CWE-829: Inclusion of Functionality from Untrusted Control Sphere, the product imports, requires, or includes executable functionality — such as a library or resource — from a source outside of the intended control sphere. The outbound-request behaviour additionally matches CWE-918: Server-Side Request Forgery.

This issue affects .NET 6. WPF ships as part of the Microsoft.WindowsDesktop.App shared framework and is Windows-only. Exposure follows from opening or printing an untrusted XPS document — no scripting or macro equivalent is required, which is what makes "just open this document" sufficient.

‍

Details

Module Info

• Product: .NET
• Affected packages: Windows Presentation Foundation (ships in the Microsoft.WindowsDesktop.App shared framework)
• Affected versions: Microsoft.WindowsDesktop.App >= 6.0.0 <= 6.0.43
• GitHub repository: https://github.com/dotnet/wpf
• Published packages: Download .NET (Linux, macOS, and Windows)
• Package manager: NuGet
• Fixed in: NES for .NET 6.0.44

Vulnerability Info

This Medium-severity vulnerability covers two distinct defects, both reachable by opening a crafted XPS document.

Package-boundary escape. Resource URIs inside an XPS document were resolved and fetched without any check that the target stayed inside the document's own package. A document could therefore name an http, https, file or UNC target, or a part belonging to a different package, and WPF would retrieve it during parsing. That converts the act of opening a document into an outbound request the user never authorised — usable to confirm that an internal host exists, to reach a network location that only the victim's machine can route to, or to read a local file into the rendered document.

The fixed release introduces an XPS loading context that publishes the package URI currently being loaded, and every sink that resolves a resource URI — the bitmap decoder, bitmap download, bitmap image, colour context, font source, pixel shader, media player state and glyph paths — now rejects a target that escapes it. The context is established and restored in a finally block in both the document and validating-loader paths, so a nested load cannot leave the ambient value pointing at the wrong package.

Default credentials sent off-zone. Separately, WPF's web request helper set UseDefaultCredentials to true unconditionally. Combined with the escape above, a URI in the Internet zone could be handed the user's NTLM or Kerberos credentials — turning information disclosure into a credential-relay opportunity. The fix gates default credentials on the URL security zone, permitting them only for the Local Machine, Intranet and Trusted zones.

The accompanying System.Printing hardening ships in the same fix: the printer DEVMODE structure now validates its declared size and driver-extra length against the buffer the spooler actually allocated before those values are trusted, behind the Switch.System.Windows.DisableDevModeValidation AppContext switch, together with matching bounds work in the interop job and printer information paths.

‍

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to one of:
  
  • .NET >= 8.0.30
  • .NET >= 9.0.19
  • .NET >= 10.0.11
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.44 or later.

‍

Credits

Microsoft credits Ky0toFu for reporting this vulnerability.