{"metadata": {"vulnerability": "CVE-2026-70007", "count": 28, "kinds": {"milestone": 9, "sighting": 4, "kev": 0, "other": 15}}, "data": [{"timestamp": "2025-08-04T16:30:00Z", "date_only": false, "value": "2025-08-04T16:30:00Z", "kind": "other", "label": "Document generated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0426", "record": "NCSC-2026-0426", "field": "document.tracking.generator.date"}, {"timestamp": "2026-08-03T23:07:44.323Z", "date_only": false, "value": "2026-08-03T23:07:44.323Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-70007", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-08T00:00:00Z", "date_only": false, "value": "2026-10-08T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-70007", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-08T00:00:00Z", "date_only": false, "value": "2026-10-08T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-70007", "record": "FKIE_CVE-2026-70007", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-13T00:00:00Z", "date_only": true, "value": "2026-10-13", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1313", "record": "CERTFR-2026-AVI-1313", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-10-13T00:00:00Z", "date_only": true, "value": "2026-10-13", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1316", "record": "CERTFR-2026-AVI-1316", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-10-13T11:56:15Z", "date_only": false, "value": "2026-10-13T11:56:15.000000Z", "kind": "sighting", "label": "Seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0426", "record": "CVE-2026-70007", "field": "creation_timestamp", "uuid": "caae9267-4b08-48c4-987d-5f36312fa6cd", "url": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0426"}, {"timestamp": "2026-10-13T14:00:00Z", "date_only": false, "value": "2026-10-13T14:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "CVE-2026-70007", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-13T18:56:15.788Z", "date_only": false, "value": "2026-10-13T18:56:15.788419Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0426", "record": "NCSC-2026-0426", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-10-13T18:56:15.788Z", "date_only": false, "value": "2026-10-13T18:56:15.788419Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2026-0426", "record": "NCSC-2026-0426", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-10-13T18:56:15.788Z", "date_only": false, "value": "2026-10-13T18:56:15.788419Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0426", "record": "NCSC-2026-0426", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-13T19:01:15.664Z", "date_only": false, "value": "2026-10-13T19:01:15.664Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-70007", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-13T19:19:11.757Z", "date_only": false, "value": "2026-10-13T19:19:11.757", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-70007", "record": "FKIE_CVE-2026-70007", "field": "published"}, {"timestamp": "2026-10-13T20:52:52Z", "date_only": false, "value": "2026-10-13T20:52:52Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-PFWJ-2F93-RF42", "record": "GHSA-PFWJ-2F93-RF42", "field": "published"}, {"timestamp": "2026-10-13T20:52:52Z", "date_only": false, "value": "2026-10-13T20:52:52Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-PFWJ-2F93-RF42", "record": "GHSA-PFWJ-2F93-RF42", "field": "modified"}, {"timestamp": "2026-10-13T22:32:58.152Z", "date_only": false, "value": "2026-10-13T22:32:58.152094Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117435975432690322", "record": "CVE-2026-70007", "field": "creation_timestamp", "uuid": "4bee68dc-0088-4b58-bd7b-c98cb03d8aea", "content": "CVE-2026-70007 .NET Framework Remote Code Execution Vulnerability Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.\nhttps://www.cve.org/CVERecord?id=CVE-2026-70007https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70007#Microsoft #.NET10.0 #.NET11.0 #.NET8.0 #.NET9.0 #Microsoft.NETFramework3.5 #Microsoft.NETFramework3.5AND4.6.2/4.7/4.7.1/4.7.2 #Microsoft.NETFramework3.5AND4.7.2 #Microsoft.NETFramework3.5AND4.8 #Microsoft.NETFramework3.5AND4.8.1 #Microsoft.NETFramework4.6.2/4.7/4.7.1/4.7.2 #Microsoft.NETFramework4.8 #Microsoft.NETFramework4.8.1 #MicrosoftVisualStudio2022version17.14 #MicrosoftVisualStudio2026version18.10#CVE_2026_70007#bot", "url": "https://infosec.exchange/users/cve/statuses/117435975432690322"}, {"timestamp": "2026-10-13T23:30:57Z", "date_only": false, "value": "2026-10-13T23:30:57.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/dba319358e490a35547519343d916bb8", "record": "CVE-2026-70007", "field": "creation_timestamp", "uuid": "3debe740-d948-43ee-905d-061b411ea51b", "content": "# CVE-2026-70007: CVE-2026-70007: Out-of-Bounds Write Vulnerability in .NET Framework and WPF Subsystem\n\n> **CVSS Score:** 8.8\n> **Published:** 2026-10-13\n> **Full Report:** https://cvereports.com/reports/CVE-2026-70007\n\n## Summary\nAn out-of-bounds write vulnerability in Microsoft .NET Framework, .NET runtime, and Visual Studio allows unauthenticated remote attackers to execute arbitrary code via crafted pixel-shader bytecode or auto-converted clipboard payloads.\n\n## TL;DR\nA heap-based out-of-bounds write vulnerability (CWE-787) in the Windows Presentation Foundation (WPF) graphics subsystem (CPSTrans::Initialize) and Clipboard API routines allows remote code execution when a targeted application processes malicious graphics assets or clipboard data.\n\n## Technical Details\n\n- **CWE ID**: CWE-787 (Out-of-bounds Write)\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 8.8 (High)\n- **EPSS Score**: Pending Baseline\n- **Impact**: Remote Code Execution (C:H/I:H/A:H)\n- **Exploit Status**: Unweaponized / No Public PoC\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Microsoft .NET 8.0\n- Microsoft .NET 9.0\n- Microsoft .NET 10.0\n- Microsoft .NET 11.0\n- Microsoft .NET Framework 3.5\n- Microsoft .NET Framework 4.6.2 / 4.7 / 4.7.1 / 4.7.2\n- Microsoft .NET Framework 4.8\n- Microsoft .NET Framework 4.8.1\n- Microsoft Visual Studio 2022\n- Microsoft Visual Studio 2026\n- **.NET 8.0**: >= 8.0.0, < 8.0.32 (Fixed in: `8.0.32`)\n- **.NET 9.0**: >= 9.0.0, < 9.0.21 (Fixed in: `9.0.21`)\n- **.NET 10.0**: >= 10.0.0, < 10.0.13 (Fixed in: `10.0.13`)\n- **.NET 11.0**: >= 11.0.0, < 11.0.0-rc.2 (Fixed in: `11.0.0-rc.2`)\n- **.NET Framework 4.8.1**: < 4.8.9363.0 (Fixed in: `4.8.9363.0`)\n- **Visual Studio 2022**: < 17.14.42 (Fixed in: `17.14.42`)\n\n## Mitigation\n\n- Apply official Microsoft security updates for affected .NET, .NET Framework, and Visual Studio products.\n- Enforce least-privilege user execution policies to limit the potential impact of code execution.\n- Monitor process trees for anomalous child process spawning from WPF hosting binaries like PresentationHost.exe.\n\n**Remediation Steps:**\n1. Identify all systems running vulnerable versions of .NET runtime (8.0, 9.0, 10.0, 11.0), .NET Framework, or Visual Studio.\n2. Deploy Microsoft Security Updates released on October 13, 2026 via Windows Update, WSUS, or enterprise deployment tools.\n3. Verify that .NET 8.0 is updated to >= 8.0.32, .NET 9.0 to >= 9.0.21, .NET 10.0 to >= 10.0.13, and .NET 11.0 to >= 11.0.0-rc.2.\n4. Ensure Visual Studio 2022 is updated to version 17.14.42 or higher.\n\n## References\n\n- [MSRC Vulnerability Advisory](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70007)\n- [Official CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-70007)\n- [MITRE ATT&CK Mapping Search](https://attack.mitre.org/search/?search=CVE-2026-70007)\n- [GitHub Patch Commit - Clipboard API AutoConvert](https://github.com/dotnet/wpf/commit/0987b406ba6087cbe14fdff1c9b67dd0c83f9076)\n- [GitHub Patch Commit - TrueType Subsetting Safeguards](https://github.com/dotnet/wpf/commit/8319b24818dbae77f5607ded9acdfb05d479c05f)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-70007) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/dba319358e490a35547519343d916bb8"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1313", "record": "CERTFR-2026-AVI-1313", "field": "last_revision_date"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1316", "record": "CERTFR-2026-AVI-1316", "field": "last_revision_date"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1313", "record": "CERTFR-2026-AVI-1313", "field": "initial_release_date"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1316", "record": "CERTFR-2026-AVI-1316", "field": "initial_release_date"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1313", "record": "CERTFR-2026-AVI-1313", "field": "revisions.0.revision_date"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1316", "record": "CERTFR-2026-AVI-1316", "field": "revisions.0.revision_date"}, {"timestamp": "2026-10-14T01:49:33Z", "date_only": false, "value": "2026-10-14T01:49:33.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.acn.gov.it/portale/w/aggiornamenti-mensili-microsoft-25", "record": "CVE-2026-70007", "field": "creation_timestamp", "uuid": "a0fb5a17-0846-4c65-b977-65f04ff03b07", "url": "https://www.acn.gov.it/portale/w/aggiornamenti-mensili-microsoft-25"}, {"timestamp": "2026-10-14T03:56:45.754Z", "date_only": false, "value": "2026-10-14T03:56:45.754Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-70007", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T04:18:28.520Z", "date_only": false, "value": "2026-10-14T04:18:28.520", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-70007", "record": "FKIE_CVE-2026-70007", "field": "lastModified"}, {"timestamp": "2026-10-16T23:24:46.183Z", "date_only": false, "value": "2026-10-16T23:24:46.183Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-70007", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-16T23:24:46.183Z", "date_only": false, "value": "2026-10-16T23:24:46.183Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / microsoft", "record": "CVE-2026-70007", "field": "containers.cna.providerMetadata.dateUpdated"}]}