CVE-2026-70007

Name of the Vulnerable Software and Affected Versions Microsoft.WindowsDesktop.App.Runtime.win-arm64 versions 8.0.0 through 8.0.31 Microsoft.WindowsDesktop.App.Runtime.win-x64 versions 8.0.0 through 8.0.31 Microsoft.WindowsDesktop.App.Runtime.win-x86 versions 8.0.0 through 8.0.31 Microsoft.WindowsDesktop.App.Runtime.win-arm64 versions 9.0.0 through 9.0.20 Microsoft.WindowsDesktop.App.Runtime.win-x64 versions 9.0.0 through 9.0.20 Microsoft.WindowsDesktop.App.Runtime.win-x86 versions 9.0.0 through 9.0.20 Microsoft.WindowsDesktop.App.Runtime.win-arm64 versions 10.0.0 through 10.0.12 Microsoft.WindowsDesktop.App.Runtime.win-x64 versions 10.0.0 through 10.0.12 Microsoft.WindowsDesktop.App.Runtime.win-x86 versions 10.0.0 through 10.0.12 Microsoft.WindowsDesktop.App.Runtime.win-arm64 versions 11.0.0-preview.1 through 11.0.0-rc.1 Microsoft.WindowsDesktop.App.Runtime.win-x64 versions 11.0.0-preview.1 through 11.0.0-rc.1 Microsoft.WindowsDesktop.App.Runtime.win-x86 versions 11.0.0-preview.1 through 11.0.0-rc.1

Description An out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network. Specifically, crafted WPF pixel-shader bytecode can desynchronize the two parsing passes in the CPSTrans::Initialize function, leading to heap out-of-bounds writes or reads.

Recommendations Update Microsoft.WindowsDesktop.App.Runtime.win-arm64 version 8.0.31 to 8.0.32 Update Microsoft.WindowsDesktop.App.Runtime.win-x64 version 8.0.31 to 8.0.32 Update Microsoft.WindowsDesktop.App.Runtime.win-x86 version 8.0.31 to 8.0.32 Update Microsoft.WindowsDesktop.App.Runtime.win-arm64 version 9.0.20 to 9.0.21 Update Microsoft.WindowsDesktop.App.Runtime.win-x64 version 9.0.20 to 9.0.21 Update Microsoft.WindowsDesktop.App.Runtime.win-x86 version 9.0.20 to 9.0.21 Update Microsoft.WindowsDesktop.App.Runtime.win-arm64 version 10.0.12 to 10.0.13 Update Microsoft.WindowsDesktop.App.Runtime.win-x64 version 10.0.12 to 10.0.13 Update Microsoft.WindowsDesktop.App.Runtime.win-x86 version 10.0.12 to 10.0.13 Update Microsoft.WindowsDesktop.App.Runtime.win-arm64 version 11.0.0-rc.1 to 11.0.0-rc.2 Update Microsoft.WindowsDesktop.App.Runtime.win-x64 version 11.0.0-rc.1 to 11.0.0-rc.2 Update Microsoft.WindowsDesktop.App.Runtime.win-x86 version 11.0.0-rc.1 to 11.0.0-rc.2 Recompile and redeploy any self-contained applications targeting the affected versions.