dotnet/wpf · error · UnauthorizedAccessException

Exception of type 'UnauthorizedAccessException' was thrown.

Error message

Exception of type 'UnauthorizedAccessException' was thrown.

What it means

The XpsManager constructor throws UnauthorizedAccessException when an existing package was opened with FileAccess.Read but the requested packageAccess is not Read (or the package's actual FileOpenAccess is not Read). Writing to a read-only opened package is not permitted, so access is denied.

Solutions

1. Open the package/file with FileAccess.ReadWrite when you intend to modify the XPS document.
2. If read-only is intentional, pass FileAccess.Read (PackageAccess.Read) and never call write APIs.
3. Clear the OS read-only attribute on the file or copy it to a writable location first.

Example fix

// before
using var doc = new XpsDocument(path, FileAccess.Read); // then writing
// after
using var doc = new XpsDocument(path, FileAccess.ReadWrite);

var fi = new FileInfo(path);
if (fi.IsReadOnly) throw new UnauthorizedAccessException($"{path} is read-only");
// open with FileAccess.ReadWrite when writing

try { doc = new XpsDocument(stream, FileAccess.ReadWrite, compression); }
catch (UnauthorizedAccessException) { doc = new XpsDocument(stream, FileAccess.Read); /* read-only flow */ }

When it happens

Trigger: Constructing XpsManager/XpsDocument on an existing file/stream with FileAccess.Read while requesting PackageAccess.Write or ReadWrite; or the underlying package was opened read-only (file on disk is read-only) but write access was requested.

Common situations: Files pulled from read-only media or marked read-only; opening an XPS from a resource stream and then attempting to save; passing FileAccess.Read with a mismatched package open mode.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• SR.ReachPackaging_CannotModifyReadOnlyContainer
• SR.RightsManagementExceptionNoRightsForOperation
• " }} " element found. Expected fixed page element ( }} ).
• ' ' ContentType is not valid.
• ' ' ContentType is not valid.

AI-assisted analysis of dotnet/wpf@81131a70a4 (2026-09-14). Data as JSON: /api/errors/f693e57a9ded6ef9. Report an issue: GitHub.

Appendix: source

Thrown at src/Microsoft.DotNet.Wpf/src/ReachFramework/Packaging/XpsManager.cs:159

                                          (packageAccess== FileAccess.Read) ?  FileMode.Open: FileMode.OpenOrCreate,
                                           packageAccess,
                                          (packageAccess== FileAccess.Read) ?  FileShare.Read: FileShare.None
                                          );
                }
                    
                AddPackageToCache( _uri, package );               
            }
            else
            {
                //
                // If either the previous opened package or
                // this open request is not File Access Read
                // throw UnauthorizedAccessException
                //
                if( packageAccess != FileAccess.Read ||
                    package.FileOpenAccess != FileAccess.Read )
                {
                    throw new UnauthorizedAccessException();
                }
                AddPackageReference( _uri );
            }
            Initialize( package,
                        compressionOption,
                        streaming);
        }

        static XpsManager()
        {
            _globalLock = new Object();
            _packageCache = new Dictionary<Uri,int>();
        }
        #endregion Constructors

        #region Public properties

        /// <summary>

View on GitHub (pinned to 81131a70a4)