high7.0
CVE-2026-62897
Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to execute code locally.
Impact
Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to execute code locally.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| nuget | Microsoft.WindowsDesktop.App.Runtime.win-arm64 | >= 10.0.0, <= 10.0.10 | 10.0.11 |
| nuget | Microsoft.WindowsDesktop.App.Runtime.win-x64 | >= 10.0.0, <= 10.0.10 | 10.0.11 |
| nuget | Microsoft.WindowsDesktop.App.Runtime.win-x86 | >= 10.0.0, <= 10.0.10 | 10.0.11 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | .Net Framework | Versions 3.5, 4.7.2, 4.8.1, 4.8 |
| Microsoft | Visual Studio 2022 | from 17.14.0 before 17.14.38 |
| Microsoft | Visual Studio 2026 | from 18.8.0 before 18.8.3 |
| Microsoft | .Net | from 8.0.0 before 8.0.30 from 9.0.0 before 9.0.19 from 10.0.0 before 10.0.11 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-fx4q-gjrx-2jw6
- https://github.com/dotnet/wpf/security/advisories/GHSA-fx4q-gjrx-2jw6
- https://nvd.nist.gov/vuln/detail/CVE-2026-62897
- https://github.com/dotnet/announcements/issues/434
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62897