Key points
- The flaw enables remote code execution after user interaction with manipulated UI Automation elements.
- Microsoft has released patched versions for .NET 8, 9, 10, and the preview releases of version 11.
- The issue is classified as high severity with a CVSS score of 8.8 due to the ease of exploitation.
Microsoft has issued patches for a high-severity remote code execution vulnerability in its .NET framework. The flaw affects Windows Desktop App Runtime packages across versions 8, 9, 10, and early previews of version 11.
What happened
The vulnerability, tracked as CVE-2026-87697, stems from the deserialization of untrusted data within Windows Presentation Foundation (WPF). According to the GitHub advisory, WPF XPS synthetic hyperlinks exposed through UI Automation can bypass restrictive navigation checks. This bypass allows the application to reach attacker-controlled content. Successful exploitation results in remote code execution on the affected system.
The issue requires user interaction to trigger. An unauthorised attacker can execute code over a network by convincing a user to interact with the compromised hyperlink. The flaw is present in the Microsoft.WindowsDesktop.App.Runtime packages for win-arm64, win-x64, and win-x86 architectures.
Microsoft rates the severity as high with a CVSS score of 8.8. The vector indicates that the attack is network-accessible with low complexity and no privileges required, but it does require user interaction. The weakness is categorised as CWE-502, which relates to the deserialization of untrusted data.
Why it matters
This flaw impacts a wide range of .NET applications running on Windows systems. The affected versions span from 8.0.0 up to 9.0.20 and 10.0.12, as well as preview builds of 11.0.0. Organisations using these specific runtime versions are exposed until they apply the provided updates.
The scope includes all Windows architectures supported by the affected packages. This means that both x86 and x64 systems, along with ARM64 devices, are potentially vulnerable if they run the unpatched software. The requirement for user interaction limits the attack vector but does not eliminate the risk for targeted attacks.
What happens next
- Identify all systems running Microsoft.WindowsDesktop.App.Runtime versions 8.0.0 to 8.0.31.
- Locate instances of .NET 9.0.0 through 9.0.20 and 10.0.0 through 10.0.12.
- Check for preview installations of .NET 11.0.0-preview.1 to 11.0.0-rc.1.
- Apply the specific patched versions listed in the advisory to remediate the issue.
Patch priority
Security teams should prioritise updating systems that are exposed to untrusted network traffic. Start by identifying public-facing applications or internal tools that process external data. Test the patched runtime versions in a non-production environment to ensure compatibility. Back up current configurations before deploying the updates. Roll out the fixes in stages, beginning with the most exposed systems. Monitor logs for any unusual activity during the transition. If immediate patching is not possible, restrict network access to the affected services.
Background: Remote code execution vulnerabilities
Remote code execution often occurs because developers trust user input without validation, fail to restrict file permissions, or neglect to update dependencies. Fix these errors by enforcing strict input sanitisation, applying least-privilege principles, and integrating automated security checks into your secure software development lifecycle to prevent arbitrary command execution.
Read the full guide: Seven Configuration Mistakes That Allow Remote Code Execution
What to do and how to stay safe: Microsoft
- Audit your inventory for Microsoft.WindowsDesktop.App.Runtime packages to identify vulnerable versions.
- Verify that your applications do not expose UI Automation elements to untrusted sources.
- Monitor network traffic for signs of exploitation attempts against WPF applications.
- Ensure that your deployment pipelines automatically pull the latest patched NuGet packages.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which .NET versions are affected by CVE-2026-87697?
Versions 8.0.0 to 8.0.31, 9.0.0 to 9.0.20, 10.0.0 to 10.0.12, and 11.0.0-preview.1 to 11.0.0-rc.1 are affected.
Is there a fix available for this vulnerability?
Yes, Microsoft has released patched versions including 8.0.32, 9.0.21, 10.0.13, and 11.0.0-rc.2.
What is the severity rating for this flaw?
The vulnerability is rated high with a CVSS score of 8.8.
