CVE-2026-70174
Description
A flaw was found in .NET. An improperly implemented security check allows an unauthorized remote attacker to execute arbitrary code over the network. Successful exploitation requires user interaction and could allow an attacker to compromise the affected system.
Statement
An improperly implemented security check flaw was found in the .NET Windows Presentation Foundation (WPF) component. An unauthenticated remote attacker could exploit this vulnerability by enticing a user to open a specially crafted document (such as an XPS file containing malicious hyperlink navigation) in an application utilizing the desktop runtime. Processing the crafted input bypasses URI restrictions and reaches attacker-controlled objects, resulting in arbitrary code execution within the privileges of the running application process.
Mitigation
Do not open untrusted XPS documents or follow unverified hyperlinks within .NET desktop applications. Restrict application execution privileges and enforce mandatory access control policies to contain unauthorized process actions.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.8 | N/A | 8.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
