Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is an integer overflow in the CGlyphRunGeometrySink class within the Windows Presentation Foundation (WPF) component of .NET. The analysis of the commits between the vulnerable version 9.0.18 and the patched version 9.0.19 of dotnet/wpf revealed a security fix for an integer overflow in CGlyphRunGeometrySink. Specifically, commit 1341c788dfdb1f2a93e7f829390f0321511e9324 addresses this vulnerability. The patch changes several member variables in the CGlyphRunGeometrySink class from int to size_t to prevent integer overflows when calculating buffer sizes for glyph rendering. The functions CGlyphRunGeometrySink::BeginFigure and CGlyphRunGeometrySink::AddGenericPoly were identified as the primary vulnerable functions because they are directly involved in memory allocation calculations that were susceptible to overflow. An attacker could exploit this by providing a crafted XPS file with a large number of complex glyphs, causing an integer overflow that leads to a heap-based buffer overflow and potential remote code execution.
CGlyphRunGeometrySink::BeginFiguresrc/Microsoft.DotNet.Wpf/src/WpfGfx/core/resources/GlyphRunGeometrySink.cpp
CGlyphRunGeometrySink::AddGenericPolysrc/Microsoft.DotNet.Wpf/src/WpfGfx/core/resources/GlyphRunGeometrySink.cpp
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Microsoft.WindowsDesktop.App.Runtime.win-arm64 | nuget | >= 10.0.0, <= 10.0.10 | 10.0.11 |
| Microsoft.WindowsDesktop.App.Runtime.win-x64 | nuget | >= 10.0.0, <= 10.0.10 | 10.0.11 |
| Microsoft.WindowsDesktop.App.Runtime.win-x86 | nuget | >= 10.0.0, <= 10.0.10 | 10.0.11 |
| Microsoft.WindowsDesktop.App.Runtime.win-arm64 | nuget | >= 9.0.0, <= 9.0.18 | 9.0.19 |
| Microsoft.WindowsDesktop.App.Runtime.win-x64 | nuget | >= 9.0.0, <= 9.0.18 | 9.0.19 |
| Microsoft.WindowsDesktop.App.Runtime.win-x86 | nuget | >= 9.0.0, <= 9.0.18 | 9.0.19 |
| Microsoft.WindowsDesktop.App.Runtime.win-arm64 | nuget | >= 8.0.0, <= 8.0.29 | 8.0.30 |
| Microsoft.WindowsDesktop.App.Runtime.win-x64 | nuget | >= 8.0.0, <= 8.0.29 | 8.0.30 |
| Microsoft.WindowsDesktop.App.Runtime.win-x86 | nuget | >= 8.0.0, <= 8.0.29 | 8.0.30 |