Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, identified as CVE-2026-70354, is an out-of-bounds write in the Windows Presentation Foundation (WPF) component of .NET. The root cause is an integer overflow vulnerability in the native C++ code that handles glyph geometry rendering. By analyzing the commits between the vulnerable version (9.0.18) and the patched version (9.0.19) of the dotnet/wpf repository, I identified the fixing commit 1341c788dfdb1f2a93e7f829390f0321511e9324.
The patch modifies the CGlyphRunGeometrySink class, which is responsible for constructing geometry from glyph outlines. The core of the vulnerability lies in the use of 32-bit signed integers (int) to track the size and offsets of the geometry data. A malicious actor could provide a font or XPS document containing a glyph with an exceptionally large and complex outline. When WPF processes this glyph, the offset counter (m_currentOffset) would exceed the maximum value for a 32-bit integer and wrap around to a small positive or negative number. This leads to a significantly smaller buffer being allocated on the heap than what is required to store the full geometry. Subsequent operations in functions like BeginFigure and AddGenericPoly would then attempt to write the large geometry data into this undersized buffer, resulting in a heap-based out-of-bounds write. This could be exploited to corrupt memory and achieve remote code execution.
The patch addresses this by changing the integer type for offset tracking from int to size_t, which is 64-bit on 64-bit platforms, providing a much larger range and preventing the overflow. Additionally, explicit checks were added in CGlyphRunGeometrySink::BeginFigure and CGlyphRunGeometrySink::AddGenericPoly to validate that the calculated geometry size does not exceed INT_MAX before any memory is allocated, effectively stopping the vulnerability at its source.
CGlyphRunGeometrySink::BeginFiguresrc/Microsoft.DotNet.Wpf/src/WpfGfx/core/resources/GlyphRunGeometrySink.cpp
CGlyphRunGeometrySink::AddGenericPolysrc/Microsoft.DotNet.Wpf/src/WpfGfx/core/resources/GlyphRunGeometrySink.cpp
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Microsoft.WindowsDesktop.App.Runtime.win-arm64 | nuget | >= 10.0.0, <= 10.0.10 | 10.0.11 |
| Microsoft.WindowsDesktop.App.Runtime.win-x64 | nuget | >= 10.0.0, <= 10.0.10 | 10.0.11 |
| Microsoft.WindowsDesktop.App.Runtime.win-x86 | nuget | >= 10.0.0, <= 10.0.10 | 10.0.11 |
| Microsoft.WindowsDesktop.App.Runtime.win-arm64 | nuget | >= 9.0.0, <= 9.0.18 | 9.0.19 |
| Microsoft.WindowsDesktop.App.Runtime.win-x64 | nuget | >= 9.0.0, <= 9.0.18 | 9.0.19 |
| Microsoft.WindowsDesktop.App.Runtime.win-x86 | nuget | >= 9.0.0, <= 9.0.18 | 9.0.19 |
| Microsoft.WindowsDesktop.App.Runtime.win-arm64 | nuget | >= 8.0.0, <= 8.0.29 | 8.0.30 |
| Microsoft.WindowsDesktop.App.Runtime.win-x64 | nuget | >= 8.0.0, <= 8.0.29 | 8.0.30 |
| Microsoft.WindowsDesktop.App.Runtime.win-x86 | nuget | >= 8.0.0, <= 8.0.29 | 8.0.30 |