Skip to content

Instantly share code, notes, and snippets.

@alon710

alon710/CVE-2026-87697.md

Created October 14, 2026 00:30
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save alon710/c06739f1b3ec99b6674dc62ab70bc728 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save alon710/c06739f1b3ec99b6674dc62ab70bc728 to your computer and use it in GitHub Desktop.
Download ZIP
CVE-2026-87697: CVE-2026-87697: Untrusted Deserialization in .NET PresentationCore Clipboard Handling - CVE Security Report
Raw
CVE-2026-87697.md

CVE-2026-87697: CVE-2026-87697: Untrusted Deserialization in .NET PresentationCore Clipboard Handling

CVSS Score: 8.8 Published: 2026-10-13 Full Report: https://cvereports.com/reports/CVE-2026-87697

Summary

A remote code execution vulnerability exists in Microsoft .NET due to untrusted data deserialization within the PresentationCore component. The flaw stems from implicit auto-conversion flags during clipboard data retrieval operations.

TL;DR

Implicit type auto-conversion in WPF PresentationCore clipboard routines allowed untrusted data streams to be automatically deserialized, enabling arbitrary code execution upon accessing clipboard data.

Technical Details

  • CWE ID: CWE-502
  • Attack Vector: Network (AV:N)
  • Attack Complexity: Low (AC:L)
  • Privileges Required: None (PR:N)
  • User Interaction: Required (UI:R)
  • CVSS v3.1 Score: 8.8 (HIGH)
  • Exploit Status: None / Unproven
  • CISA KEV Status: Not Listed

Affected Systems

  • Microsoft .NET 8.0
  • Microsoft .NET 9.0
  • Microsoft .NET 10.0
  • Microsoft .NET 11.0
  • Microsoft Visual Studio 2022 (v17.14)
  • Microsoft Visual Studio 2026 (v18.10)
  • .NET 8.0: >= 8.0.0, < 8.0.32 (Fixed in: 8.0.32)
  • .NET 9.0: >= 9.0.0, < 9.0.21 (Fixed in: 9.0.21)
  • .NET 10.0: >= 10.0.0, < 10.0.13 (Fixed in: 10.0.13)
  • .NET 11.0: >= 11.0.0, < 11.0.0-rc.2 (Fixed in: 11.0.0-rc.2)
  • Visual Studio 2022: >= 17.14.0, < 17.14.42 (Fixed in: 17.14.42)
  • Visual Studio 2026: >= 18.10.0, < 18.10.4 (Fixed in: 18.10.4)

Mitigation

  • Upgrade .NET SDK and runtime components to fixed servicing releases.
  • Explicitly set autoConvert: false when querying external IDataObject contents in WPF application code.
  • Restrict user execution privileges for applications interacting with untrusted clipboard inputs.

Remediation Steps:

  1. Identify all installed instances of .NET 8.0, 9.0, 10.0, 11.0, and Visual Studio build hosts.
  2. Apply security update builds: .NET 8.0.32, .NET 9.0.21, .NET 10.0.13, or .NET 11.0.0-rc.2.
  3. Update Visual Studio 2022 installations to 17.14.42 and Visual Studio 2026 to 18.10.4.
  4. Recompile WPF applications against the updated target SDKs.

References

Generated by CVEReports - Automated Vulnerability Intelligence

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment