What is the CVSS score of CVE-2026-32183?

CVE-2026-32183 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Microsoft are affected by CVE-2026-32183?

CVE-2026-32183 is a command injection vulnerability in Windows Snipping Tool affecting Windows 10, 11, and Server 2012-2025 that enables local code execution when users open malicious files.. A patch is available.

How to fix or mitigate CVE-2026-32183?

Within 24 hours: Identify all Windows 10, 11, and Server 2012-2025 systems in your environment and verify current patch status via WSUS or endpoint management console. Within 7 days: Deploy the vendor-released patch to all affected systems using your standard Windows Update process or manual deployment; prioritize user-facing workstations and administrative machines. Within 30 days: Complete 100% patch compliance verification across all endpoints and servers; implement application whitelisting or disable Snipping Tool via Group Policy (Set-MpPreference -DisableRealtimeMonitoring or equivalent controls) on systems where the tool is not required.

Microsoft CVE-2026-32183

EUVD-2026-22564 HIGH

Command Injection (CWE-77)

2026-04-14 microsoft

GHSA-gxcr-wwm9-8r9r

Command Injection Microsoft

7.8

CVSS 3.1 · NVD

Temporal: 6.8

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.8 MEDIUM

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:22 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 19:21 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 17:46 euvd

EUVD-2026-22564

Analysis Generated

Apr 14, 2026 - 17:46 vuln.today

Patch released

Apr 14, 2026 - 17:46 nvd

Patch available

CVE Published

Apr 14, 2026 - 16:57 nvd

HIGH 7.8

DescriptionCVE.org

Improper neutralization of special elements used in a command ('command injection') in Windows Snipping Tool allows an unauthorized attacker to execute code locally.

AnalysisAI

Command injection in Windows Snipping Tool allows local code execution when an unauthorized attacker convinces a user to open a specially crafted file. This vulnerability affects all supported Windows 10, Windows 11, and Windows Server versions (2012 through 2025), requiring user interaction but no authentication (PR:N). No public exploit identified at time of analysis, though the local attack vector and user interaction requirement limit immediate remote threat. CVSS 7.8 reflects high impact ac

Technical ContextAI

This vulnerability stems from CWE-77 (Command Injection), where the Windows Snipping Tool fails to properly neutralize special elements in user-supplied input before passing them to system command execution contexts. The Snipping Tool, a built-in Windows screenshot utility present since Windows Vista, processes image files and metadata. The flaw likely resides in how the tool parses file format structures (such as PNG, JPEG metadata, or proprietary formats) or command-line arguments, allowing an attacker to embed command syntax that gets executed by the underlying Windows command interpreter. The vulnerability affects a remarkably broad product range spanning over a decade of Windows releases, from legacy Windows Server 2012 (build 6.2.9200.0) through cutting-edge Windows 11 26H1 and Windows Server 2025, indicating the vulnerable code component has persisted across major architectural changes and long-term servicing branches.

RemediationAI

Apply vendor-released patches immediately through Windows Update or Microsoft Update Catalog. Fixed versions per EUVD data: Windows 10 1607/Server 2016 build 10.0.14393.9060 or later, Windows 10 1809/Server 2019 build 10.0.17763.8644 or later, Windows 10 21H2 build 10.0.19044.7184 or later, Windows 10 22H2 build 10.0.19045.7184 or later, Windows 11 22H3/23H2 build 10.0.22631.6936 or later, Windows 11 24H2/Server 2025 build 10.0.26100.32690 or later, Windows 11 25H2 build 10.0.26200.8246 or later, Windows 11 26H1 build 10.0.28000.1836 or later, Windows Server 2012 build 6.2.9200.26026 or later, Windows Server 2012 R2 build 6.3.9600.23132 or later, Windows Server 2022 build 10.0.20348.5020 or later, Windows Server 2022 23H2 build 10.0.25398.2274 or later. Organizations unable to patch immediately should implement user awareness training to