What is the CDF-MS file format?
A .cdf-ms file is a manifest cache file used by the Windows ClickOnce deployment system and the side-by-side (SxS/Fusion) component runtime. It contains assembly identity declarations, dependency references, file entries, and a digital signature - information the runtime needs to locate, verify, and launch a ClickOnce application or .NET component.
Role of manifest files
.cdf-ms files are written automatically by the ClickOnce runtime, not by users. Most copies are UTF-8 XML and can be inspected in a text editor. Because each file carries an XML-DSIG digital signature, any attempt to modify a .cdf-ms file will invalidate its signature and can prevent the application from running properly. The right remediation is to repair or reinstall the application, not to edit the cache file directly.
.cdf-ms manifest files are typically named after the application they refer to - for example, application.exe is accompanied by application.exe.cdf-ms. Unlike a plain MANIFEST file embedded in a Windows PE binary, a .cdf-ms is a separate cache artifact tied to the ClickOnce deployment pipeline, first introduced with .NET Framework 2.0 in November 2005. MSIX is Microsoft's preferred modern packaging alternative.
Security & safety
RISK: LOWA .cdf-ms itself is an inert manifest (usually XML) and cannot execute on its own, so reading one is harmless. The real-world caution is the same as for ClickOnce generally: the cache belongs to an app that was downloaded and run from some publisher's URL, and ClickOnce deployment links have been abused to install malware (2023-2024 campaigns). Do not hand-delete .cdf-ms files to "fix" things - that can corrupt the ClickOnce cache; use the app's repair/reinstall. Treat the underlying ClickOnce app, not this cache file, as where any trust decision belongs.
Format details
in a nutshell- Channel Definition Format (CDF) - Late-1990s Microsoft/IE 'Active Channel' XML push format used .cdf - historical and unrelated to ClickOnce.
Programs that open CDF-MS files
Windows3 apps
ClickOnce / side-by-side runtime (Windows, .NET)
Built-in Not user-opened: the .NET ClickOnce/SxS runtime reads and writes .cdf-ms automatically when installing, updating or launching a ClickOnce app.
Notepad++ / VS Code (inspect only)
Open-source Open a .cdf-ms as text/XML just to read the assembly identity and dependencies. Read-only; editing breaks the signature and the cached app.
Visual Studio (mage.exe / mageui.exe)
Freemium Developer tooling: the Manifest Generation tools view/sign ClickOnce manifests. Used for authoring, not for end-user 'opening'. Technical details
deep spec| Encoding | Primarily UTF-8 XML; some cache copies stored in compact binary form |
| Encryption | None (integrity via XML-DSIG digital signature, not encryption) |
| Typical file size | 1 KB - 50 KB |
| MIME type | application/octet-stream (binary cache); application/xml (when read as text) |
| XML root element | <assembly> or <asmv1:assembly> in the asm.v1/asm.v2 manifest namespaces |
| Integrity mechanism | XML Digital Signature (XML-DSIG) and/or Authenticode hash entries |
| Deployment system | Windows ClickOnce / side-by-side (SxS) Fusion component store |
| File naming convention | Mirrors the target executable (e.g., app.exe.cdf-ms) |
| Cache location | Per-user ClickOnce component store directory (under AppData) |
| Modification risk | Editing invalidates the XML-DSIG signature, breaking application launch |
| Operating systems | Windows only |
| Released | 2005 (ClickOnce, .NET Framework 2.0 / Visual Studio 2005) |
| Latest version | Tied to the ClickOnce/Fusion runtime shipping with current .NET (5+/8) |
| Specification | learn.microsoft.com |
CDF-MS conversions
Community Q&A
asked by usersNo questions yet - be the first to ask about CDF-MS files.
