Patch .NET 8-11 Now: Microsoft Fixes High-Severity Integer Overflow Allowing Remote Privilege Escalation

Microsoft has released security updates to address a high-severity elevation of privilege vulnerability in the .NET Framework. The flaw, identified as CVE-2026-85363, involves an integer overflow that can allow an unauthorized attacker to gain higher privileges over a network. System administrators should apply the latest patches immediately to protect their environments from potential exploitation.

In plain English

An integer overflow occurs when a calculation produces a number larger than the system can handle, causing it to wrap around to a smaller value. In this case, attacker-controlled XPS glyph coordinates trigger this overflow. The error affects pointer arithmetic in a specific function, leading to an out-of-bounds write. This can cause the process to terminate or potentially allow privilege escalation.

The background

The vulnerability exists in Microsoft.WindowsDesktop.App.Runtime packages used for Windows Presentation Foundation applications. It affects multiple versions of the .NET runtime, including versions 8.0, 9.0, 10.0, and preview releases of 11.0. The issue impacts all Windows architectures, including x64, x86, and ARM64. Microsoft classifies the weakness as CWE-190, which refers to integer overflow or wraparound errors.

What changes now

Developers and administrators must update their applications to use the patched versions of the affected packages. For .NET 8.0, the fix is in version 8.0.32. For .NET 9.0, version 9.0.21 contains the correction. .NET 10.0 users should move to version 10.0.13. Those using .NET 11.0 preview builds must upgrade to version 11.0.0-rc.2. These updates resolve the integer overflow issue in the glyph rendering component.

Key terms explained

When software handles numbers that exceed their maximum size, it may wrap around to zero or a negative value, creating unexpected behavior. In security contexts, this can corrupt memory or bypass checks. Teams usually review input validation for numerical data to prevent such errors. Check whether your applications handle large values from external sources safely. Ensure that any data used for memory calculations is bounded and verified before processing. Regular code reviews help catch these logic errors early in development.

Background: Privilege escalation attacks

Privilege escalation is the act of exploiting a bug, design flaw, or configuration oversight to gain elevated access to applications or data. Attackers use these techniques to move from a limited user account to an administrator or root level, allowing them to install malware, steal data, or persist within your environment.

Read the full guide: Privilege Escalation Attacks: How Attackers Steal Control

What to do and how to stay safe: Microsoft

• Identify all systems running affected versions of Microsoft.WindowsDesktop.App.Runtime packages.
• Update to the patched versions: 8.0.32, 9.0.21, 10.0.13, or 11.0.0-rc.2 as applicable.
• Monitor logs for unusual process terminations or privilege changes following updates.
• Verify that all dependent applications are tested and functioning correctly after the update.

Step-by-step guide: Risk-Based Vulnerability Management: Benefits, Limits, and Reality

General security guidance from the Vector Update newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-85363?

The CVSS 3.1 score is 8.8, which is classified as high severity.

Which architectures are affected by this vulnerability?

All Windows architectures are affected, including x64, x86, and ARM64.

Is there a patch available for .NET 8.0?

Yes, the patched version for .NET 8.0 is 8.0.32.