CVE-2026-70354: Out-of-Bounds Write in .NET Windows Presentation Foundation Subsystem

CVE-2026-70354 is a high-severity local code execution vulnerability affecting several versions of the Microsoft .NET runtime, .NET Framework, and Microsoft Visual Studio. The flaw is located within the Windows Presentation Foundation (WPF) rendering and layout parsing subsystems. These subsystems handle the rasterization and composition of complex vector shapes, text elements, and graphical layouts.

The vulnerability is classified as an out-of-bounds write (CWE-787) occurring at the boundary between managed and native code execution. Specifically, WPF relies on a native C++ rendering engine, commonly implemented in wpfgfx_v0400.dll (MilCore), to process high-performance layout computations. By presenting a malformed layout, font resource, or graphical element, an attacker can corrupt native heap structures.

An unauthorized local attacker can leverage this memory corruption to execute arbitrary code within the security context of the user running the host application. If the vulnerable application runs with elevated or administrative privileges, this vulnerability can also facilitate local privilege escalation. This attack surface is exposed in any desktop application or development tool utilizing the affected WPF libraries.

The root cause of CVE-2026-70354 resides in the insufficient validation of size constraints and the absence of integer overflow prevention during the parsing of complex graphical paths and layouts. WPF utilizes a highly optimized native drawing engine that allocates memory blocks dynamically based on metadata embedded in UI assets. These assets include dynamic vector geometry paths, OpenType or TrueType font tables, and XML Paper Specification (XPS) files.

When a vulnerable component processes these assets, it calculates the necessary heap allocation size by multiplying the element count with the individual element size. For instance, the rendering engine multiplies the width, height, and bytes-per-pixel parameters to determine pixel buffer allocations. If an attacker delivers input containing disproportionately large coordinates or count fields, this multiplication operation overflows the maximum capacity of standard integer types.

The resulting wrap-around produces a small integer value that is subsequently passed to the native memory allocation routine, such as HeapAlloc or a managed-to-native interop allocator. Consequently, the operating system allocates a heap buffer that is significantly smaller than the actual volume of data that will be written. When the rendering engine proceeds to copy the source data using the original, unvalidated larger count, it writes data past the allocated memory boundary.

This out-of-bounds write corrupts the metadata structures of the adjacent native heap blocks. By controlling the content and structure of the overflowing data, an attacker can overwrite critical control data, such as virtual method tables (vtables) or function pointers. This corruption redirects the CPU instruction pointer to target locations, bypassing standard code isolation measures.

The vulnerability is addressed by introducing strict integer arithmetic validation and checking boundary conditions before invoking memory operations. In the vulnerable version of the parsing logic, size computations were performed without overflow checks, which directly led to the undersized memory allocations.

// Vulnerable Native Layout Engine Pattern
HRESULT MilCoreParser::AllocateBuffer(DWORD elementCount, DWORD elementSize, BYTE** ppBuffer) {
    // Bypasses overflow detection; multiplication wraps around
    DWORD totalSize = elementCount * elementSize; 
    *ppBuffer = (BYTE*)HeapAlloc(GetProcessHeap(), 0, totalSize);
    if (*ppBuffer == NULL) {
        return E_OUTOFMEMORY;
    }
    return S_OK;
}

The patch replaces these vulnerable arithmetic patterns with safe calculation interfaces, ensuring that any integer overflow immediately aborts the allocation process. By utilizing safe math helper functions, the engine ensures that the product of the dimensions does not exceed the valid boundaries of the data types.

// Patched Native Layout Engine Pattern
#include <safeint.h>
 
HRESULT MilCoreParser::AllocateBuffer(DWORD elementCount, DWORD elementSize, BYTE** ppBuffer) {
    DWORD totalSize;
    // Utilizing safe arithmetic to detect overflow before allocation
    if (!SafeMultiply(elementCount, elementSize, &totalSize)) {
        return E_INVALIDARG; // Abort if integer overflow is detected
    }
    
    *ppBuffer = (BYTE*)HeapAlloc(GetProcessHeap(), 0, totalSize);
    if (*ppBuffer == NULL) {
        return E_OUTOFMEMORY;
    }
    return S_OK;
}

Additionally, the servicing updates within the dotnet/wpf repository, such as those in the release branch release/10.0 (commit 6e295c0c870baf4c02897e89d53e2f3e4a6aeba5), ensure that dependencies on external drawing, interop, and WinForms components are bumped to safe versions. This ensures that any indirect vectors invoking vulnerable rendering functions are blocked.

Exploitation of CVE-2026-70354 requires the attacker to craft a malicious graphical layout, custom font file, or XPS document and deliver it to a target system. The attack vector is local, meaning the exploitation occurs on the victim's physical machine, or relies on a user executing a malicious client-side document within a vulnerable application context.

The attacker first constructs a malicious asset, such as an XPS visual document or an EMF graphic, containing coordinates designed to trigger the integer overflow in wpfgfx_v0400.dll. The layout parameters are structured to yield a tiny integer after multiplication wraps around. This results in the allocation of a very small native heap buffer (e.g., 64 bytes) while the copy loop is instructed to write several kilobytes of data.

When the victim opens the file in a vulnerable .NET application, the rendering engine processes the asset and performs the under-allocated heap copy. The overflow overwrites the adjacent heap structures, replacing native class function pointers with addresses that point to a controlled payload, such as a shellcode buffer. Upon invoking the corrupted object's virtual method, execution jumps to the attacker's shellcode, executing it within the security context of the active user.

The CVSS base score for CVE-2026-70354 is evaluated at 7.8, reflecting its high-severity rating. The vulnerability has a local attack vector (AV:L), low attack complexity (AC:L), requires no privileges (PR:N), and necessitates user interaction (UI:R). This indicates that while the vulnerability cannot be exploited remotely without user participation, it remains highly reliable once a user opens a malformed file.

Successful exploitation results in a complete compromise of confidentiality, integrity, and availability within the execution context of the hosting process (C:H/I:H/A:H). Because .NET and WPF applications frequently run as standard user applications, the attacker inherits the full permissions of the logged-in user. If the application runs as an administrative service, the exploit leads to complete system compromise.

Currently, this vulnerability is not cataloged in the CISA Known Exploited Vulnerabilities (KEV) list, and there are no reports of active exploitation in the wild. However, due to the widespread usage of WPF in enterprise desktop software, the potential exposure remains significant for organizations running unpatched client systems.

The primary remediation strategy is to apply the security updates released by Microsoft during the August 2026 Patch Tuesday cycle. Systems running affected versions of the .NET runtime must be upgraded to version 10.0.11, 9.0.19, or 8.0.30 respectively. Organizations utilizing .NET Framework 3.5, 4.6.2, 4.7, 4.8, or 4.8.1 should deploy the cumulative Windows servicing updates to apply the native-level fixes.

In environments where immediate patching is not possible, security administrators should implement strong host-isolation policies. Restrict the loading of custom fonts and forbid users from opening XPS documents or loading unverified XAML files from external or untrusted sources. Additionally, configuring standard user accounts without administrative privileges limits the damage of potential privilege escalation vectors.

Detection of exploitation attempts can be achieved through both host-level auditing and application monitoring. Security teams should monitor system event logs for unexpected terminations or crashes in applications utilizing the wpfgfx_v0400.dll library. Security Information and Event Management (SIEM) systems can be configured to alert on abnormal child processes spawned by desktop applications built on .NET or Visual Studio, which often signals an active injection or code execution payload.