CVE-2026-96235

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

A memory corruption vulnerability (CVE-2026-96235) has been identified in the pixel-shader translator of Windows Presentation Foundation (WPF). Crafted pixel-shader bytecode can make the translator's two parsing passes disagree, so it writes, or reads, past the end of a heap allocation in the application that renders the shader.

Per CWE-787: Out-of-bounds Write, the weakness is a product that writes data past the end, or before the beginning, of the intended buffer.

This issue affects WPF on .NET 6, including NES for .NET releases up to and including 6.0.46. WPF is Windows-only, and exploitation requires user interaction: a user must open or load content that carries the crafted shader. Microsoft's advisory lists .NET 8.0, 9.0, 10.0 and the 11.0 previews as affected; .NET 6 is past end of life and is not assessed there, and HeroDevs confirmed that 6.0 carries the same code path.

Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

Details

Module Info

• Product: Any NES for .NET 6 WPF application on Windows at version 6.0.46 or earlier.
• Affected packages: Windows Desktop shared framework (Microsoft.WindowsDesktop.App, runtime pack Microsoft.WindowsDesktop.App.Runtime.win-x64), native code in wpfgfx_cor3.dll
• Affected versions:
  
  • >= 6.0.0 <= 6.0.46
• Package manager: NuGet, Windows Installer
• GitHub repository: https://github.com/dotnet/wpf
• Published packages: Download .NET (Windows)
• Fixed in:
  
  • NES for .NET 6.0.47

Vulnerability Info

This High-severity vulnerability is found in CPSTrans::Initialize, the translator WPF's software rasterizer uses to compile pixel shaders such as those behind a ShaderEffect. The translator reads shader bytecode in two passes: the first counts instructions and allocates a heap buffer for them, and the second fills it in. Crafted bytecode can make the second pass consume a different number of tokens than the first, for example when a DCL register token or the constants of a DEF instruction are not skipped, so the second pass writes more instructions than the first pass allocated room for. That is an out-of-bounds write on the heap. A separate loop in the first pass also read parameter tokens without a bounds check.

NES for .NET 6.0.47 makes both passes consume the same tokens, checks that they agree on the instruction and token counts, and adds bounds checks on the bytecode, including rejecting bytecode whose length is not a whole number of tokens. CVE-2026-70007, CVE-2026-96224 and CVE-2026-96235 were reported separately and are addressed together by the same pixel-shader translator hardening in NES for .NET 6.0.47.

Most of these checks can be turned off with the existing WPF opt-out switch Switch.MS.Internal.WpfGfx.DisableWpfGfxBoundsCheckProtection, which also turns off earlier WPF graphics bounds checks. Setting it weakens this fix, so leave it unset unless a documented compatibility problem requires it.

This vulnerability has been present since at least .NET (WPF) 6.0 and likely earlier.

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected WPF applications to one of:
  • NES for .NET 6.0.47 or later
  • .NET Desktop Runtime 8.0.32 or later
  • .NET Desktop Runtime 9.0.21 or later
  • .NET Desktop Runtime 10.0.13 or later
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.47 or later.

Credits

Mateusz Gierblinski with Curios, as credited in Microsoft's advisory.