CVE-2026-96224

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

A memory corruption vulnerability (CVE-2026-96224) has been identified in the pixel-shader translator of Windows Presentation Foundation (WPF). Crafted pixel-shader bytecode can make the translator's two parsing passes disagree, so it writes, or reads, past the end of a heap allocation in the application that renders the shader.

Per CWE-787: Out-of-bounds Write, the weakness is a product that writes data past the end, or before the beginning, of the intended buffer.

This issue affects WPF on .NET 6, including NES for .NET releases up to and including 6.0.46. WPF is Windows-only, and exploitation requires user interaction: a user must open or load content that carries the crafted shader. Microsoft's advisory lists .NET 8.0, 9.0, 10.0 and the 11.0 previews as affected; .NET 6 is past end of life and is not assessed there, and HeroDevs confirmed that 6.0 carries the same code path.

Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

Details

Module Info

• Product: Any NES for .NET 6 WPF application on Windows at version 6.0.46 or earlier.
• Affected packages: Windows Desktop shared framework (Microsoft.WindowsDesktop.App, runtime pack Microsoft.WindowsDesktop.App.Runtime.win-x64), native code in wpfgfx_cor3.dll
• Affected versions:
  
  • >= 6.0.0 <= 6.0.46
• Package manager: NuGet, Windows Installer
• GitHub repository: https://github.com/dotnet/wpf
• Published packages: Download .NET (Windows)
• Fixed in:
  
  • NES for .NET 6.0.47

Vulnerability Info

This High-severity vulnerability is found in CPSTrans::Initialize, the translator WPF's software rasterizer uses to compile pixel shaders such as those behind a ShaderEffect. The translator reads shader bytecode in two passes: the first counts instructions and allocates a heap buffer for them, and the second fills it in. A DCL declaration instruction carries a register token. The first pass always consumed that token, but the second pass consumed it only when its high bit was set. Otherwise the token was parsed again as a new instruction, so the second pass wrote more instructions than the first pass had allocated room for, an out-of-bounds write on the heap.

NES for .NET 6.0.47 makes the second pass always consume the register token and adds checks that both passes agree on the instruction and token counts, alongside other bounds checks on the bytecode. CVE-2026-70007, CVE-2026-96224 and CVE-2026-96235 were reported separately and are addressed together by the same pixel-shader translator hardening in NES for .NET 6.0.47.

This part of the fix is unconditional, as it is upstream. The WPF opt-out switch Switch.MS.Internal.WpfGfx.DisableWpfGfxBoundsCheckProtection turns off the other checks in the change but cannot reintroduce this bug.

This vulnerability has been present since at least .NET (WPF) 6.0 and likely earlier.

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected WPF applications to one of:
  • NES for .NET 6.0.47 or later
  • .NET Desktop Runtime 8.0.32 or later
  • .NET Desktop Runtime 9.0.21 or later
  • .NET Desktop Runtime 10.0.13 or later
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.47 or later.

Credits

Aobo Wang (@m4x_1997), kayiz with Lien Phat Technology Corporation, Quac Tran, Muhammad Abdul Rehman, Ky0toFu (@ky0tofu) and 41ae55e9310ff27fa6f26af4727e5590, as credited in Microsoft's advisory.