CVE-2026-70007: Out-of-Bounds Write Vulnerability in .NET Framework and WPF Subsystem

CVE-2026-70007 is an out-of-bounds write vulnerability impacting the Microsoft .NET Framework, .NET runtime environments, and Microsoft Visual Studio. The flaw resides within the Windows Presentation Foundation (WPF) graphics rendering component (milcore / wpfgfx) and managed data handling routines in PresentationCore. These components process complex graphical structures and clipboard data abstractions across managed applications.

The primary attack vector involves the processing of pixel-shader bytecode models (such as PS_2_0 and PS_3_0) and coerced clipboard objects. When a WPF-enabled application processes a malformed payload, internal allocation sizing calculations fail. This causes the runtime to allocate insufficient buffer space for shader instructions, leading to dynamic heap memory corruption during subsequent write operations.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary code within the context of the user operating the target application. Depending on the process privileges, an attacker could gain full system control, inspect memory contents, or execute unauthorized software. Microsoft assigned this vulnerability a CVSS v3.1 base score of 8.8 with low attack complexity.

The underlying root cause stems from a multi-pass parsing desynchronization within the native WPF graphics engine (milcore / wpfgfx), specifically inside CPSTrans::Initialize. When processing pixel-shader bytecode streams, the parser operates in two distinct execution passes: Pass 1 calculates required memory allocations based on instruction tokens, while Pass 2 decodes instruction opcodes and writes translated structures into the allocated buffer.

A logical inconsistency between Pass 1 and Pass 2 allows malformed bytecode streams—such as payloads containing invalid register indices or altered stream lengths—to bypass sizing checks. During Pass 1, stream boundaries are evaluated incorrectly, leading to an under-calculated heap allocation size. When Pass 2 subsequently processes the stream, it writes decoded payload structures beyond the allocated memory boundary into adjacent heap memory, resulting in an out-of-bounds write (CWE-787).

A secondary vulnerability path exists in PresentationCore.dll within the managed System.Windows.Clipboard implementation. Functions like GetTypedDataIfAvailable hardcoded autoConvert: true during data retrieval operations. This allowed incoming clipboard streams to execute unconditional type conversions across untrusted format types, bypassing intended strict format boundaries and increasing exposure to malformed inputs.

Analysis of the patch commits reveals modifications across both managed clipboard conversion routines and native font subsetting checks. In PresentationCore/System/Windows/clipboard.cs, the static helper GetTypedDataIfAvailable<T> was updated to dynamically evaluate format auto-conversion permissions rather than forcing data coercion unconditionally.

The managed fix enforces dynamic verification via IsDataFormatAutoConvert(format) to prevent unwanted format conversion paths during clipboard data extraction. The modified code path is structured as follows:

// Unpatched implementation:
private static T? GetTypedDataIfAvailable<T>(string format)
{
    IDataObject? data = GetDataObject();
    if (data is ITypedDataObject typed)
    {
        return typed.TryGetData(format, autoConvert: true, out T? value) ? value : default;
    }
    if (data is IDataObject dataObject)
    {
        return dataObject.GetData(format, autoConvert: true) is T value ? value : default;
    }
    return default;
}
 
// Patched implementation:
private static T? GetTypedDataIfAvailable<T>(string format)
{
    IDataObject? data = GetDataObject();
    bool autoConvert = IsDataFormatAutoConvert(format);
 
    if (data is ITypedDataObject typed)
    {
        return typed.TryGetData(format, autoConvert, out T? value) ? value : default;
    }
 
    if (data is IDataObject dataObject)
    {
        return dataObject.GetData(format, autoConvert) is T value ? value : default;
    }
 
    return default;
}

Additionally, in the native TrueType subsetting module TtfDelta/modtable.cpp, bounds checking logic was updated to validate subtable sizes against the explicit 32-bit table directory size (TTTableLength) rather than relying solely on the 16-bit header length field (KernSubHeader.length):

// Patched validation in TtfDelta/modtable.cpp:
if ((uint32)usKernFormat0Size + ulPairsSize > TTTableLength(pOutputBufferInfo, KERN_TAG))
    return ERR_GENERIC;

This explicit length check prevents integer truncation conditions when processing table structures larger than 64 KB, blocking potential memory write overflows.

Exploitation of CVE-2026-70007 requires delivering a malformed graphics asset, document, or payload to a system running a vulnerable .NET runtime or Visual Studio installation. Common attack vectors include embedding manipulated pixel-shader bytecode or TrueType fonts inside documents, standalone WPF executables, or web applications rendered via PresentationHost.exe.

The attack scenario requires user interaction, such as opening an untrusted file or copying malicious data into the active clipboard. Once processed by the WPF runtime, CPSTrans::Initialize evaluates the payload and allocates heap memory based on the flawed sizing pass. As the second pass executes, controlled byte sequences overwrite memory past the buffer boundary.

Because the bug manifests as a heap-based out-of-bounds write (CWE-787), an attacker capable of manipulating process heap layout can overwrite execution control pointers or object vtables to achieve arbitrary code execution. The attack operates within the security context of the target application without requiring local privilege escalation. No public proof-of-concept exploits or active exploitation in the wild have been reported at publication time.

The overall security impact of CVE-2026-70007 is High, reflected by its CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Successful exploitation compromises confidentiality, integrity, and system availability by allowing arbitrary code execution under the privileges of the target user process.

On enterprise workstations, an attacker executing code via a rendered document could exfiltrate confidential files, install persistent backdoors, or move laterally across local network segments. On developer systems running Visual Studio, payload execution could lead to source code access or compromised build output pipelines.

While the vulnerability requires user interaction (UI:R), the attack complexity is rated Low (AC:L) because no complex timing constraints or race conditions are required once the malicious stream is loaded. Organizations deploying unpatched .NET runtime channels face persistent client-side operational risk.

The primary remediation for CVE-2026-70007 is applying official security patches released by Microsoft on October 13, 2026. System administrators must upgrade affected .NET runtime installations to patched release versions: .NET 8.0 to 8.0.32 or higher, .NET 9.0 to 9.0.21 or higher, .NET 10.0 to 10.0.13 or higher, and .NET 11.0 to 11.0.0-rc.2.

For systems utilizing .NET Framework, security updates should be deployed based on the underlying Windows operating system and target framework version (e.g., updating .NET Framework 4.8.1 to build 4.8.9363.0 or higher). Developer environments running Visual Studio must update Visual Studio 2022 to build 17.14.42 or later and Visual Studio 2026 to build 18.10.4.

In environments where immediate patch deployment is delayed, security teams should implement least-privilege administrative controls and restrict file execution from untrusted network locations. Endpoint detection mechanisms should monitor for anomalous child process creation originating from PresentationHost.exe or heap crash anomalies in wpfgfx_v0400.dll and PresentationCore.dll.