Loading story…
Microsoft confirmed that August 2026 .NET Framework security updates are causing some Windows Presentation Foundation (WPF) applications to fail when printing or exporting to PDF/XPS. The bug affects supported Windows 10, Windows 11, and Windows Server versions from 2012 through 2025, and is triggered in scenarios involving certain fonts or character sets, with Calibri specifically cited. Affected applications may throw System.IO.FileFormatException during printing or document generation.
Microsoft said it is investigating and published a temporary developer workaround that enables the AppContext switch Switch.MS.Internal.TtfDelta.DisableCmapAndSbitOverflowProtection in application configuration. The company warned that the workaround disables protections added in the August update and could expose systems to vulnerabilities fixed that month, including flaws that may enable remote code execution or privilege escalation. Microsoft also advised against uninstalling the August .NET updates because removing them would reopen patched security issues.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft confirmed the issue in release health and updated release notes, saying it is investigating the problem. The company published a temporary workaround that enables the Switch.MS.Internal.TtfDelta.DisableCmapAndSbitOverflowProtection AppContext switch, while warning that it disables protections added in the August 2026 update and should be used only when necessary.
Microsoft's August 2026 Patch Tuesday .NET Framework security updates introduced a side effect that causes some Windows Presentation Foundation applications to fail when printing or generating PDF/XPS content using certain fonts, including Calibri, sometimes with a System.IO.FileFormatException.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourceheise.de
Open sourcebleepingcomputer.com
Open sourcesupport.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft published security advisories for a series of **Windows PrintWorkflowUserSvc Elevation of Privilege** vulnerabilities affecting the Windows printing workflow service. The issues were assigned multiple CVEs, including `CVE-2024-49095`, `CVE-2025-21235`, `CVE-2025-55331`, `CVE-2025-55684`, `CVE-2025-55685`, `CVE-2025-55686`, `CVE-2025-55688`, `CVE-2025-55689`, and `CVE-2025-55691`, indicating repeated security weaknesses in the same Windows component. The advisories provide limited public detail, but each entry classifies the issue as an **elevation of privilege** flaw in `PrintWorkflowUserSvc`, a service tied to Windows print processing. For defenders, the cluster signals that organizations running Windows endpoints and print-enabled systems should prioritize Microsoft security updates covering this service, review exposure across workstation and server fleets, and monitor for post-compromise activity that could indicate local privilege escalation through the printing stack.
Jul 12, 2026
Microsoft released security bulletin **MS15-010** to fix six vulnerabilities in the Windows kernel-mode driver and related components, including the critical remote code execution flaw **CVE-2015-0059** in `Win32k.sys`. The bug could let an attacker run code if a user opened a specially crafted document or visited an untrusted website containing embedded TrueType fonts. Microsoft rated the update **Critical** for supported editions of Windows 7, Windows Server 2008 R2, Windows 8, Windows 8.1, Windows Server 2012, Windows Server 2012 R2, Windows RT, and Windows RT 8.1, and **Important** for supported editions of Windows Server 2003, Windows Vista, and Windows Server 2008. The bulletin also addressed elevation of privilege, security feature bypass, and denial of service issues, including one publicly disclosed vulnerability, **CVE-2015-0010**, and five privately reported flaws. Microsoft said none of the vulnerabilities were known to be under active exploitation at publication, and said the fixes strengthened parameter validation, impersonation enforcement, object handling, user-mode data validation, TrueType font error checking, and font width checks. The company separately clarified that update `3037639` was a non-security fix for text quality degradation caused by update `3013455` on some older Windows versions and was not required for security protection.
Jun 29, 2026
An accidentally published proof-of-concept exploit exposed the Windows Print Spooler flaw known as **PrintNightmare**, showing that authenticated users could achieve remote code execution as `SYSTEM`, including on Active Directory domain controllers where the Print Spooler service was often enabled by default. The bug was tied to `CVE-2021-1675`, which Microsoft had initially treated as a privilege-escalation issue before reclassifying it as remote code execution, prompting warnings that ransomware operators could quickly weaponize the vulnerability and that even fully patched Windows Server 2019 domain controllers might remain at risk until a dedicated fix arrived. Microsoft responded with the `KB5004945` emergency security update for supported Windows versions, but the patch caused widespread printer connectivity failures, with Zebra label printers among the most visible affected devices and reports indicating other brands were also impacted. Microsoft acknowledged the printing issue as a known problem and advised affected users to either remove the update or reinstall printers with administrative credentials, while earlier mitigation guidance for the underlying threat had urged organizations to disable the Print Spooler service on domain controllers and other critical servers until a more complete remediation was available.
Jun 29, 2026