CVE-2026-96234
published 2026-10-13CVE-2026-96234: Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.
PriorityP429medium5.3CVSS 3.1
AVNACHPRNUIRSUCHINAN
EPSS
0.28%
19.6th percentile
Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft_visual_studio_2022_version_17.14 | >= 17.14.0 < 17.14.42 | 17.14.42 |
| microsoft | microsoft_visual_studio_2026_version_18.10 | >= 18.10.0 < 18.10.4 | 18.10.4 |
| microsoft | net_10.0_runtime | >= 10.0.0 < 10.0.13 | 10.0.13 |
| microsoft | net_11.0_runtime | >= 11.0.0 < 11.0.0-rc.2 | 11.0.0-rc.2 |
| microsoft | net_8.0_runtime | >= 8.0.0 < 8.0.32 | 8.0.32 |
| microsoft | net_9.0_runtime | >= 9.0.0 < 9.0.21 | 9.0.21 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
ghsa5.3MEDIUM
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Microsoft .NET/Visual Studio up to 8.0.31/9.0.20/10.0.12/11.0.0-rc.1 WPF origin validation
vuldb·2026-10-14·CVSS 5.3
CVE-2026-96234 [MEDIUM] Microsoft .NET/Visual Studio up to 8.0.31/9.0.20/10.0.12/11.0.0-rc.1 WPF origin validation
A vulnerability classified as problematic was found in Microsoft .NET and Visual Studio up to 8.0.31/9.0.20/10.0.12/11.0.0-rc.1. The impacted element is an unknown function of the component WPF. Such manipulation leads to origin validation error.
This vulnerability is traded as CVE-2026-96234. The attack may be launched remotely. There is no exploit available.
Upgrading the affected component is advised.
GHSA
Microsoft Security Advisory CVE-2026-96234 - .NET and Visual Studio Information Disclosure Vulnerability
ghsa·2026-10-13·CVSS 5.3
CVE-2026-96234 [MEDIUM] CWE-346 Microsoft Security Advisory CVE-2026-96234 - .NET and Visual Studio Information Disclosure Vulnerability
Microsoft Security Advisory CVE-2026-96234 - .NET and Visual Studio Information Disclosure Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
Restrictive XAML and XPS security fixes block unsafe URI fetching and navigation, propagate untrusted-input state through hyperlink navigation, add TrueType font protection and XAML nesting-depth limits, and avoid caching positive DNS zone-policy decisions.
## Announcement
Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/482
## CVSS Details
- **Version:** 3.1
- *
Red Hat
dotnet: .NET Information Disclosure Vulnerability
vendor_redhat·2026-10-13·CVSS 5.3
CVE-2026-96234 [MEDIUM] CWE-346 dotnet: .NET Information Disclosure Vulnerability
dotnet: .NET Information Disclosure Vulnerability
Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.
A flaw was found in .NET. An origin validation error allows an unauthorized remote attacker to disclose sensitive information over the network. Successful exploitation requires user interaction and enables an attacker to access restricted data without proper authorization.
No detection rules found.
No public exploits indexed.
Sans Isc
October 2026 Microsoft Patch Tuesday, (Tue, Oct 13th)
blogs_sans_isc·2026-10-13·CVSS 8.8
CVE-2026-96951 [HIGH] October 2026 Microsoft Patch Tuesday, (Tue, Oct 13th)
October 2026 Microsoft Patch Tuesday
Published: 2026-10-13. Last Updated: 2026-10-13 19:25:52 UTC
by Johannes Ullrich (Version: 1)
0 comment(s)
Microsoft today released patches for 1,417 vulnerabilities. 76 of these vulnerabilities are rated critical, with 7 critical vulnerabiilties requiring no customer actions. One vulnerability was disclosed before today's patch Tuesday, and one is already exploited.
CVE-2026-96951: An already exploited Windows Shell Security Feature Bypass Vulnerability. This vulnerabliity allows bypassing the "Mark of the Web" making it easier to exeucte code by sending a malicious message to a user via e-mail or instant messaging. The victim will still have to open the file.
CVE-2026-108398: This vulnerability, a .NET framework security feature bypass, could be
Rapid7
Patch Tuesday - October 2026
blogs_rapid7·2026-10-13·CVSS 8.8
CVE-2026-96951 [HIGH] Patch Tuesday - October 2026
Microsoft is publishing 1,413 own-product vulnerabilities on October 2026 Patch Tuesday , including 1,102 vulnerabilities in Windows. Anyone who enjoyed last month’s record-setting Patch Tuesday will love the October 2026 edition, because it’s much bigger still. As Rapid7 has noted over the course of 2026, there is every reason to suppose that vulnerability volumes will continue to rise. Microsoft is aware of exploitation in the wild for just one of the vulnerabilities published today, as well as public disclosure for two others.
## Windows Shell: zero-day security feature bypass
The Windows Shell is Microsoft’s term for the GUI interaction logic for the entire OS provided by explorer.exe and associated libraries and APIs, and for the second time this year , the Windows Shell is the site
Bugzilla
CVE-2026-96234 dotnet: .NET Information Disclosure Vulnerability
bugzilla·2026-10-13·CVSS 5.3
CVE-2026-96234 [MEDIUM] CVE-2026-96234 dotnet: .NET Information Disclosure Vulnerability
CVE-2026-96234 dotnet: .NET Information Disclosure Vulnerability
Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.
Affected products:
- .NET Windows Desktop Runtime (release 9.0): 9.0.0 - 9.0.20; fixed 9.0.21
- .NET Windows Desktop Runtime (release 10.0): 10.0.0 - 10.0.12; fixed 10.0.13
- .NET Windows Desktop Runtime (release 8.0): 8.0.0 - 8.0.31; fixed 8.0.32
- .NET Windows Desktop Runtime (release 11.0): 11.0.0-preview.1 - 11.0.0-rc.1; fixed 11.0.0-rc.2
2026-10-13
Published