Microsoft issues .NET 8-11 patches to seal Windows Desktop remote info disclosure flaw across all architectures

Microsoft has released security updates for .NET Windows Desktop runtimes to address a high severity information disclosure vulnerability. The flaw, tracked as CVE-2026-96232, stems from an out-of-bounds read error within the Microsoft.WindowsDesktop.App.Runtime packages. This issue affects applications built using WPF on Windows platforms across all supported architectures. The vulnerability allows an unauthorised attacker to disclose sensitive information over a network connection without requiring user interaction or prior authentication.

Root cause

The underlying weakness is classified as CWE-125, an out-of-bounds read. According to Microsoft’s advisory, the issue resides within the .NET runtime components specifically designated for Windows Desktop applications. The flaw enables memory content to be read beyond intended boundaries, potentially exposing data to remote attackers. This type of error typically arises when software fails to validate the length of data before accessing memory locations associated with that data.

Attack path

An attacker can exploit this vulnerability remotely over a network. The CVSS vector indicates that no user interaction is required for the attack to succeed. The flaw does not require prior authentication, allowing unauthorised access. Successful exploitation results in high impact on confidentiality, while integrity and availability remain unaffected. The attack complexity is rated as low, making it accessible to threat actors with basic network access to vulnerable services.

Affected versions

• .NET 11.0.0-preview.1 through 11.0.0-rc.1 (patched in 11.0.0-rc.2)
• .NET 9.0.0 through 9.0.20 (patched in 9.0.21)
• .NET 8.0.0 through 8.0.31 (patched in 8.0.32)
• .NET 10.0.0 through 10.0.12 (patched in 10.0.13)

All affected packages include win-arm64, win-x64 and win-x86 variants.

Mitigation

• Update Microsoft.WindowsDesktop.App.Runtime packages to the patched versions listed above.
• Verify that build pipelines pull the latest NuGet package versions.
• Confirm that deployed applications are running the updated runtime binaries.
• Monitor network logs for unusual data exfiltration patterns post-update.

What it means for organisations

Teams should immediately inventory all applications using affected .NET Desktop runtimes. Engineering leads must coordinate with security operations to verify patch deployment across development and production environments. Suppliers providing managed services or hosted applications should be contacted to confirm their remediation status. Internal communication should outline the risk of information disclosure and the urgency of updating dependencies. Regular audits of dependency trees will help prevent similar exposure from unpatched libraries in the future.

Background: Data exfiltration

Data exfiltration moves information from a protected environment to an attacker-controlled location. It relies on legitimate network protocols, hidden data channels, and the victim’s own trust. You can interrupt this process by monitoring outbound traffic, restricting data movement, and validating the integrity of your supply chain.

Read the full guide: How Data Exfiltration Works: The Silent Stages of Theft

What to do and how to stay safe: Microsoft

• Check your project files for references to vulnerable .NET Desktop runtime versions.
• Update NuGet packages to the latest patched versions before rebuilding applications.
• Scan your deployment environments to ensure old runtime versions are removed.
• Monitor for any unexpected network traffic that might indicate exploitation.

General security guidance from the TechSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the severity of CVE-2026-96232?

It is rated as high severity with a CVSS score of 7.5.

Which .NET versions are affected?

Versions 8, 9, 10 and 11 preview releases are affected.

Is user interaction required to exploit this flaw?

No, the vulnerability can be exploited remotely without user interaction.