CVE-2026-85363

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

A memory corruption vulnerability (CVE-2026-85363) has been identified in the glyph rendering of Windows Presentation Foundation (WPF), which allows an attacker to write outside a graphics buffer by supplying glyph coordinates, for example in a crafted XPS document, that overflow the renderer's pointer arithmetic.

Per CWE-190: Integer Overflow or Wraparound, the weakness is a product performing a calculation that can produce an integer overflow or wraparound when the logic assumes the result will always be larger than the original value.

This issue affects WPF on .NET 6, including NES for .NET releases up to and including 6.0.46. WPF is Windows-only, and exploitation requires user interaction: a user must open or display the crafted content. The vulnerable code runs only when WPF renders text with hardware acceleration. Microsoft's advisory lists .NET 8.0, 9.0, 10.0 and the 11.0 previews as affected; .NET 6 is past end of life and is not assessed there, and HeroDevs confirmed that 6.0 carries the same code path.

Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

Details

Module Info

• Product: Any NES for .NET 6 WPF application on Windows at version 6.0.46 or earlier.
• Affected packages: Windows Desktop shared framework (Microsoft.WindowsDesktop.App, runtime pack Microsoft.WindowsDesktop.App.Runtime.win-x64), native code in wpfgfx_cor3.dll
• Affected versions:
  
  • >= 6.0.0 <= 6.0.46
• Package manager: NuGet, Windows Installer
• GitHub repository: https://github.com/dotnet/wpf
• Published packages: Download .NET (Windows)
• Fixed in:
  
  • NES for .NET 6.0.47

Vulnerability Info

This High-severity vulnerability is found in CD3DGlyphBank::RectFillAlpha, which copies rendered glyph pixels into a locked Direct3D surface on WPF's hardware text path. It computed each destination row's address as the surface pitch multiplied by the row number, in 32-bit arithmetic. Attacker-controlled glyph coordinates can push that product past the 32-bit range, so the address wraps to a location about 4 GiB away from the surface and the copy writes out of bounds, corrupting memory or terminating the process. An earlier fix had widened only the source-side arithmetic.

NES for .NET 6.0.47 performs all five destination calculations in 64-bit arithmetic and, right after the surface is locked, checks that the glyph rectangle is well formed and that the widest write stays inside the surface, rejecting the glyph otherwise.

The protection can be turned off with the existing WPF opt-out switch Switch.MS.Internal.WpfGfx.DisableWpfGfxBoundsCheckProtection, which also turns off earlier WPF graphics bounds checks. Setting it removes this fix, so leave it unset unless a documented compatibility problem requires it.

This vulnerability has been present since at least .NET (WPF) 6.0 and likely earlier.

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected WPF applications to one of:
  • NES for .NET 6.0.47 or later
  • .NET Desktop Runtime 8.0.32 or later
  • .NET Desktop Runtime 9.0.21 or later
  • .NET Desktop Runtime 10.0.13 or later
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.47 or later.

Credits

Ky0toFu (@ky0tofu), as credited in Microsoft's advisory.