dotnet/wpf · error · FileFormatException

Document contains multiple Rights Management Encryption…

Error message

Document contains multiple Rights Management Encryption Transforms.

What it means

While enumerating the data-space transforms during Open, more than one transform with the RightsManagementEncryptionTransform identifier was found. The format allows at most one RM transform, so a FileFormatException is thrown as the document structure is invalid.

Solutions

Regenerate the document with a correct producer (save again via the legitimate RM-protecting application)
Treat the file as corrupt: detect FileFormatException on Open and reject/fallback, do not attempt repair of the transform table
If programmatically constructing files, never register the RM transform more than once in the DataSpaceManager

Example fix

// before
var env = EncryptedPackageEnvelope.Open(path); // throws on double RM transform
// after
try { var env = EncryptedPackageEnvelope.Open(path); }
catch (FileFormatException ex) { LogCorruptPackage(path, ex); } // mark file unusable

Defensive patterns

Strategy: try-catch

Validate before calling

// Inspect data-space transforms before open
var dsm = StorageInfo.Open(path).GetDataSpaceManager();
int rmCount = dsm.GetDataTransforms().Count(t => string.Equals(t.TransformIdentifier, RightsManagementEncryptionTransform.ClassTransformIdentifier, StringComparison.OrdinalIgnoreCase));
if (rmCount > 1) throw new InvalidDataException("Multiple RM transforms.");

Try / catch

try { var env = EncryptedPackageEnvelope.Open(path); }
catch (FileFormatException ex) { LogCorrupt(path, ex); RejectFile(path); }

Prevention

Never register the RM transform more than once when building data spaces
Reject/hand-off files flagged as corrupt rather than attempting in-place repair
Resave protected documents with the original producer to normalize structure

When it happens

Trigger: EncryptedPackageEnvelope.Open on a compound file whose DataSpaceManager lists two or more transforms whose TransformIdentifier equals RightsManagementEncryptionTransform.ClassTransformIdentifier — typically from corrupted or hand-edited files, or files produced by buggy third-party writers.

Common situations: Files tampered with or merged incorrectly; files written by non-Microsoft producers of RM-protected content; low-level storage corruption after disk issues.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

AI-assisted analysis of dotnet/wpf@81131a70a4 (2026-09-14). Data as JSON: /api/errors/736ec71dbfc7cdb7. Report an issue: GitHub.

Appendix: source

Thrown at src/Microsoft.DotNet.Wpf/src/WindowsBase/System/IO/Packaging/EncryptedPackage.cs:899

            //If the StreamInfo exists we go on to check if correct transform has been
            //applied to the Stream

            DataSpaceManager dsm = _root.GetDataSpaceManager();

            List<IDataTransform> transforms = dsm.GetTransformsForStreamInfo(siPackage);

            RightsManagementEncryptionTransform rmet = null;

            foreach (IDataTransform dataTransform in transforms)
            {
                if (dataTransform.TransformIdentifier is string id &&
                    string.Equals(id, RightsManagementEncryptionTransform.ClassTransformIdentifier, StringComparison.OrdinalIgnoreCase))
                {
                    // Do not allow more than one RM Transform
                    if (rmet != null)
                    {
                        throw new FileFormatException(SR.MultipleRightsManagementEncryptionTransformFound);
                    }

                    rmet = dataTransform as RightsManagementEncryptionTransform;
                }
            }

            if (rmet == null)
            {
                throw new FileFormatException(SR.RightsManagementEncryptionTransformNotFound);
            }

            //
            //  There is no reason to further push initialization of the Rights Management 
            //  data (parsing publish / use license). It will add unnecessary costs to the 
            //  scenarios where RM license are not relevant, for example indexing and 
            //  working with document properties            
            //

View on GitHub (pinned to 81131a70a4)