Microsoft Security Advisory CVE-2026-70035

Advisories.Gitlab • October 14, 2026

Microsoft is releasing this security advisory to provide information a vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

Restrictive XAML and XPS security fixes block unsafe URI fetching and , propagate untrusted-input state through hyperlink , add TrueType font protection and XAML nesting-depth limits, and avoid caching positive DNS zone-policy decisions.

github.com /advisories/GHSA-4j9v-h7pp-725h

github.com /dotnet/announcements/issues/451

github.com /dotnet/wpf/issues/12017

github.com /dotnet/wpf/security/advisories/GHSA-4j9v-h7pp-725h

nvd.nist.gov /vuln/detail/CVE-2026-70035

Code Behaviors & Features

Detect and mitigate CVE-2026-70035 with GitLab Dependency Scanning

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Microsoft Issues Security Advisory for CVE-2026-70035 Vulnerability On October 13, 2026, Microsoft published a security advisory for CVE-2026-70035, a vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF). This flaw allows for potential remote code execution through unsafe URI fetching and untrusted input handling. Affected systems include.NET projects using specific vulnerable package versions. The CVSS score for this vulnerability is 8.8, categorizing it as high severity. Developers are advised to update their applications to mitigate the risk. The advisory includes guidance on identifying affected packages and updating to secure versions. The vulnerability is linked to CWE-502, which involves deserialization of untrusted data. As of now, there are no reports of in the wild. 1 sources 58

Extracted Entities

CVEs (1)

CVE-2026-70035

Domains (2)

microsoft.windowsdesktop.app nvd.nist.gov