CVE-2026-70174

Microsoft Security Advisory CVE-2026-70174 - .NET and Visual Studio Remote Code Execution Vulnerability

Published Oct 13, 2026

CVE-2026-70174 is listed by Microsoft Security Advisory CVE-2026-70174 - .NET and Visual Studio Remote Code Execution Vulnerability.

Code

The project this record applies to. Exploit listings stay in References.

Detection, updates, and resolution for this record.

Oct 13, 2026 · GitLab Advisory Database
Detected
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. WPF XPS hyperlink navigation can bypass URI restrictions and reach an attacker-controlled ObjectDataProvider, enabling remote code execution

CVE.orgVulnerability recordCVE-2026-70174
Official CVE identifier
cve.org
FIRST EPSSExploitation probabilityCVE-2026-70174
30-day exploitation probability 0.8%
first.org
GitLab Advisory DatabasePackage advisoryCVE-2026-70174
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. WPF XPS hyperlink navigation can bypass URI restrictions and reach an attacker-controlled ObjectDataProvider, enabling remote code execution
advisories.gitlab.com
NCSC NetherlandsGovernment advisoryCVE-2026-70174
Microsoft heeft kwetsbaarheden verholpen in diverse componenten van de Developer Tools, zoals .NET en Visual Studio. Een kwaadwillende kan aanvallen uitvoeren die kunnen leiden tot de categoriën schade zoals weergegeven in de onderstaande tabellen. .NET: |------------------|-----
advisories.ncsc.nl