{"vulnerability": "CVE-2026-87697", "sightings": [{"uuid": "69f970ec-f66e-4c85-ada6-c61e199c199b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-87697", "type": "seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0426", "content": "", "creation_timestamp": "2026-10-13T11:56:15.000000Z"}, {"uuid": "291ce297-c33a-435b-9a2b-0580fa6e9c02", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-87697", "type": "seen", "source": "https://gist.github.com/alon710/c06739f1b3ec99b6674dc62ab70bc728", "content": "# CVE-2026-87697: CVE-2026-87697: Untrusted Deserialization in .NET PresentationCore Clipboard Handling\n\n> **CVSS Score:** 8.8\n> **Published:** 2026-10-13\n> **Full Report:** https://cvereports.com/reports/CVE-2026-87697\n\n## Summary\nA remote code execution vulnerability exists in Microsoft .NET due to untrusted data deserialization within the PresentationCore component. The flaw stems from implicit auto-conversion flags during clipboard data retrieval operations.\n\n## TL;DR\nImplicit type auto-conversion in WPF PresentationCore clipboard routines allowed untrusted data streams to be automatically deserialized, enabling arbitrary code execution upon accessing clipboard data.\n\n## Technical Details\n\n- **CWE ID**: CWE-502\n- **Attack Vector**: Network (AV:N)\n- **Attack Complexity**: Low (AC:L)\n- **Privileges Required**: None (PR:N)\n- **User Interaction**: Required (UI:R)\n- **CVSS v3.1 Score**: 8.8 (HIGH)\n- **Exploit Status**: None / Unproven\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Microsoft .NET 8.0\n- Microsoft .NET 9.0\n- Microsoft .NET 10.0\n- Microsoft .NET 11.0\n- Microsoft Visual Studio 2022 (v17.14)\n- Microsoft Visual Studio 2026 (v18.10)\n- **.NET 8.0**: >= 8.0.0, < 8.0.32 (Fixed in: `8.0.32`)\n- **.NET 9.0**: >= 9.0.0, < 9.0.21 (Fixed in: `9.0.21`)\n- **.NET 10.0**: >= 10.0.0, < 10.0.13 (Fixed in: `10.0.13`)\n- **.NET 11.0**: >= 11.0.0, < 11.0.0-rc.2 (Fixed in: `11.0.0-rc.2`)\n- **Visual Studio 2022**: >= 17.14.0, < 17.14.42 (Fixed in: `17.14.42`)\n- **Visual Studio 2026**: >= 18.10.0, < 18.10.4 (Fixed in: `18.10.4`)\n\n## Mitigation\n\n- Upgrade .NET SDK and runtime components to fixed servicing releases.\n- Explicitly set autoConvert: false when querying external IDataObject contents in WPF application code.\n- Restrict user execution privileges for applications interacting with untrusted clipboard inputs.\n\n**Remediation Steps:**\n1. Identify all installed instances of .NET 8.0, 9.0, 10.0, 11.0, and Visual Studio build hosts.\n2. Apply security update builds: .NET 8.0.32, .NET 9.0.21, .NET 10.0.13, or .NET 11.0.0-rc.2.\n3. Update Visual Studio 2022 installations to 17.14.42 and Visual Studio 2026 to 18.10.4.\n4. Recompile WPF applications against the updated target SDKs.\n\n## References\n\n- [Microsoft Vulnerability Advisory](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-87697)\n- [CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-87697)\n- [dotnet/wpf Fix Commit](https://github.com/dotnet/wpf/commit/0987b406ba6087cbe14fdff1c9b67dd0c83f9076)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-87697) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-14T00:30:57.000000Z"}, {"uuid": "1987704f-9455-4489-9680-2f852e9de740", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-87697", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117438284634251854", "content": "CVE-2026-87697 .NET Remote Code Execution Vulnerability Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.\nhttps://www.cve.org/CVERecord?id=CVE-2026-87697https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-87697#Microsoft #.NET10.0 #.NET11.0 #.NET8.0 #.NET9.0 #MicrosoftVisualStudio2022version17.14 #MicrosoftVisualStudio2026version18.10#CVE_2026_87697#bot", "creation_timestamp": "2026-10-14T08:20:13.651506Z"}, {"uuid": "fd629285-2572-49af-9ed3-b0e99daa96e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-87697", "type": "seen", "source": "https://www.acn.gov.it/portale/w/aggiornamenti-mensili-microsoft-25", "content": "", "creation_timestamp": "2026-10-14T01:49:33.000000Z"}]}