CVE-2026-70035
Microsoft Security Advisory CVE-2026-70035 - .NET and Visual Studio Remote Code Execution Vulnerability
Published Oct 13, 2026
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Restrictive XAML and XPS security fixes block unsafe URI fetching and navigation, propagate untrusted-input state through hyperlink navigation, add TrueType font protection and XAML nesting-depth limits, and avoid caching positive DNS zone-policy decisions.
Timeline
Detection, updates, and resolution for this record.
Oct 13, 2026 · GitLab Advisory Database
Detected
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Restrictive XAML and XPS security fixes block unsafe URI fetching and navigation, propagate untrusted-input state through hyperlink navigati
Affected
- nuget microsoft.windowsdesktop.app.runtime.win-arm64version unspecified
- nuget microsoft.windowsdesktop.app.runtime.win-x64version unspecified
- nuget microsoft.windowsdesktop.app.runtime.win-x86version unspecified
Sources
- CVE.orgCVE-2026-70035
Official CVE identifier
cve.org - FIRST EPSSCVE-2026-70035
30-day exploitation probability 1.3%
first.org - GitLab Advisory DatabaseCVE-2026-70035
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Restrictive XAML and XPS security fixes block unsafe URI fetching and navigation, propagate untrusted-input state through hyperlink navigati
advisories.gitlab.com