CVE-2026-70035

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

A remote code execution vulnerability (CVE-2026-70035) has been identified in Windows Presentation Foundation (WPF) hyperlink navigation, which can allow an attacker to run arbitrary code when a user follows a hyperlink inside untrusted XAML that WPF loaded in its restricted mode.

Per CWE-502: Deserialization of Untrusted Data, the weakness is a product that deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. In WPF, loading XAML markup turns it into live objects, so markup an attacker controls is untrusted serialized data.

This issue affects WPF on .NET 6, including NES for .NET releases up to and including 6.0.46. WPF is Windows-only, and exploitation requires user interaction: a user must open attacker-supplied content in a WPF application and follow a link in it. Microsoft's advisory lists .NET 8.0, 9.0, 10.0 and the 11.0 previews as affected; .NET 6 is past end of life and is not assessed there, and HeroDevs confirmed that 6.0 carries the same code path.

Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

Details

Module Info

• Product: Any NES for .NET 6 WPF application on Windows at version 6.0.46 or earlier.
• Affected packages: Windows Desktop shared framework (Microsoft.WindowsDesktop.App, runtime pack Microsoft.WindowsDesktop.App.Runtime.win-x64)
• Affected versions:
  
  • >= 6.0.0 <= 6.0.46
• Package manager: NuGet, Windows Installer
• GitHub repository: https://github.com/dotnet/wpf
• Published packages: Download .NET (Windows)
• Fixed in: NES for .NET 6.0.47

Vulnerability Info

This High-severity vulnerability is found in the XAML loading and navigation paths of WPF in .NET 6. WPF loads untrusted markup through a restrictive XAML reader that refuses to construct dangerous types such as ObjectDataProvider. That protection applied to the content itself but not to where its hyperlinks led. When a user followed a Hyperlink inside restrictively loaded XAML, NavigationService loaded the target page through the permissive reader, so attacker-controlled markup at the target could run code in the context of the application.

The fix marks the root of every restrictively loaded element tree through a new RestrictiveXamlContext attached property, set by XamlReader and WpfXamlLoader. NavigationService now checks the source of each navigation and, when it comes from restrictively loaded content, loads the target through the restrictive reader as well.

CVE-2026-70035, CVE-2026-70174, CVE-2026-83520, CVE-2026-87697, CVE-2026-96229, CVE-2026-96232 and CVE-2026-96234 were reported separately and are addressed together by the same WPF restrictive-XAML and XPS security update in NES for .NET 6.0.47.

This vulnerability has been present since at least .NET (WPF) 6.0 and likely earlier.

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected WPF applications to one of:
  
  • NES for .NET 6.0.47 or later
  • .NET Desktop Runtime 8.0.32 or later
  • .NET Desktop Runtime 9.0.21 or later
  • .NET Desktop Runtime 10.0.13 or later
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.47 or later.

The new protection is on by default. The Switch.System.Windows.Navigation.OptOutOfRestrictiveXamlNavigationBlock AppContext switch turns it off for applications that cannot yet work with it, but doing so restores the vulnerable behavior and should only be a short-term compatibility measure.

Credits

Vincent55 Yang (https://vincent55.tw/), as credited in Microsoft's advisory.