CVE-2026-70035 is a remote code execution flaw in Microsoft .NET Windows Desktop Runtime (WPF), from unsafe deserialization and URI handling in XAML and XPS. No exploitation is confirmed. Affected: .NET 8, 9, 10 and 11 preview runtimes. Fix: update to 8.0.32, 9.0.21, 10.0.13 or 11.0.0-rc.2. https://github.com/advisories/GHSA-4j9v-h7pp-725h #Windows #infosec #cybersecurity