CVE-2026-70007

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

A memory corruption vulnerability (CVE-2026-70007) has been identified in the pixel-shader translator of Windows Presentation Foundation (WPF). Crafted pixel-shader bytecode can make the translator's two parsing passes disagree, so it writes, or reads, past the end of a heap allocation in the application that renders the shader.

Per CWE-787: Out-of-bounds Write, the weakness is a product that writes data past the end, or before the beginning, of the intended buffer.

This issue affects WPF on .NET 6, including NES for .NET releases up to and including 6.0.46. WPF is Windows-only, and exploitation requires user interaction: a user must open or load content that carries the crafted shader. Microsoft's advisory lists .NET 8.0, 9.0, 10.0 and the 11.0 previews as affected; .NET 6 is past end of life and is not assessed there, and HeroDevs confirmed that 6.0 carries the same code path.

Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

Details

Module Info

• Product: Any NES for .NET 6 WPF application on Windows at version 6.0.46 or earlier.
• Affected packages: Windows Desktop shared framework (Microsoft.WindowsDesktop.App, runtime pack Microsoft.WindowsDesktop.App.Runtime.win-x64), native code in wpfgfx_cor3.dll
• Affected versions:
  
  • >= 6.0.0 <= 6.0.46
• Package manager: NuGet, Windows Installer
• GitHub repository: https://github.com/dotnet/wpf
• Published packages: Download .NET (Windows)
• Fixed in: NES for .NET 6.0.47

Vulnerability Info

This High-severity vulnerability is found in CPSTrans::Initialize, the translator WPF's software rasterizer uses to compile pixel shaders such as those behind a ShaderEffect. The translator reads shader bytecode in two passes: the first counts instructions and allocates a heap buffer for them, and the second fills it in. When a DEF, DEFI or DEFB instruction named a destination that was not a constant register, the second pass did not skip the instruction's constant tokens and parsed them as further instructions. The second pass then wrote more instructions than the first pass had allocated room for, an out-of-bounds write on the heap.

NES for .NET 6.0.47 makes the second pass skip those tokens and adds checks that both passes agree on the instruction and token counts, alongside other bounds checks on the bytecode. CVE-2026-70007, CVE-2026-96224 and CVE-2026-96235 were reported separately and are addressed together by the same pixel-shader translator hardening in NES for .NET 6.0.47.

The protection can be turned off with the existing WPF opt-out switch Switch.MS.Internal.WpfGfx.DisableWpfGfxBoundsCheckProtection, which also turns off earlier WPF graphics bounds checks. Setting it removes this fix, so leave it unset unless a documented compatibility problem requires it.

This vulnerability has been present since at least .NET (WPF) 6.0 and likely earlier.

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected WPF applications to one of:
  
  • NES for .NET 6.0.47 or later
  • .NET Desktop Runtime 8.0.32 or later
  • .NET Desktop Runtime 9.0.21 or later
  • .NET Desktop Runtime 10.0.13 or later
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.47 or later.

Credits

phrolo7a, Muhammad Abdul Rehman, SOMESH SONUNE, Matheus Siqueira, thegoldmandm, Aobo Wang (@m4x_1997), Mateusz Gierblinski with Curios (https://curios-it.eu/), m0ssser (https://m0ssser-portfolio.pages.dev/) and Alex Hannah, as credited in Microsoft's advisory.