CVE-2026-96234

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

An information disclosure vulnerability (CVE-2026-96234) has been identified in Windows Presentation Foundation (WPF) web requests, where DNS poisoning and a stale cached decision can lead WPF to send a user's Windows credentials to a server the attacker controls.

Per CWE-346: Origin Validation Error, the weakness is a product that does not properly verify that the source of data or communication is valid.

This issue affects WPF on .NET 6, including NES for .NET releases up to and including 6.0.46. WPF is Windows-only, and exploitation is harder than for most issues in this release: it requires user interaction and an attacker who can influence how a host name resolves for the victim. Microsoft's advisory lists .NET 8.0, 9.0, 10.0 and the 11.0 previews as affected; .NET 6 is past end of life and is not assessed there, and HeroDevs confirmed that 6.0 is affected as described below.

Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

Details

Module Info

• Product: Any NES for .NET 6 WPF application on Windows at version 6.0.46 or earlier.
• Affected packages: Windows Desktop shared framework (Microsoft.WindowsDesktop.App, runtime pack Microsoft.WindowsDesktop.App.Runtime.win-x64)
• Affected versions:
  
  • >= 6.0.0 <= 6.0.46
• Package manager: NuGet, Windows Installer
• GitHub repository: https://github.com/dotnet/wpf
• Published packages: Download .NET (Windows)
• Fixed in: NES for .NET 6.0.47

Vulnerability Info

This Medium-severity vulnerability is found in the zone policy that decides whether WPF attaches the user's default Windows credentials to its outgoing web requests in .NET 6. Since NES for .NET 6.0.44, DefaultCredentialsZonePolicy allows those credentials only for the local machine, intranet and trusted hosts, partly by resolving the host name and checking that every address is private. That answer was cached for the lifetime of the process. If the name later resolved somewhere else, for example after DNS poisoning or rebinding, WPF kept treating the host as local and sent the user's credentials to the new address.

The fix stops caching positive decisions, so every request that would send credentials re-resolves the host. Negative decisions are still cached, for two minutes, because a stale refusal is safe. There is no opt-out switch for this change.

Releases before NES for .NET 6.0.44, including Microsoft's final 6.0.36, have no zone check at all and send default credentials to any host, which was addressed separately as CVE-2026-62902. Upgrading to 6.0.47 resolves both.

CVE-2026-70035, CVE-2026-70174, CVE-2026-83520, CVE-2026-87697, CVE-2026-96229, CVE-2026-96232 and CVE-2026-96234 were reported separately and are addressed together by the same WPF restrictive-XAML and XPS security update in NES for .NET 6.0.47.

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected WPF applications to one of:
  
  • NES for .NET 6.0.47 or later
  • .NET Desktop Runtime 8.0.32 or later
  • .NET Desktop Runtime 9.0.21 or later
  • .NET Desktop Runtime 10.0.13 or later
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.47 or later.

Credits

nono, piropatriot, Ali Az, Anonymous, kayiz with Lien Phat Technology Corporation, Muhammad Abdul Rehman and Ky0toFu (@ky0tofu), as credited in Microsoft's advisory.