Windows PDF CVE-2026-69586

Exploitation requires that the target host render an attacker-supplied PDF using the Windows PDF component - the concrete prerequisite is that the malicious PDF reaches a rendering path (manual open, preview/thumbnail, indexing, or an application built on Windows.Data.Pdf). The CVSS vector states PR:N/UI:N (no authentication, no user interaction), implying automated preview/index rendering can trigger it without a click, though the practical trigger for many delivery methods is still a victim receiving and processing the file. Limiting factors: only the enumerated Windows 10/11/Server builds below the fixed versions are vulnerable, patched systems are immune, and exploitation depends on the vulnerable Windows PDF runtime actually being invoked rather than a third-party viewer.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H yields 9.8 and describes the worst case: network reachable, low complexity, no privileges, no user interaction, full CIA impact. That combination is aggressive for a document-parsing bug, which normally requires a victim to open or preview a file (UI:R); the UI:N here likely reflects automated preview/thumbnail/indexing paths that render PDFs without an explicit user click, but this should be verified against the MSRC advisory. EPSS is not provided, the CVE is not in CISA KEV, and no public POC is indicated, so there is currently no evidence of active exploitation - the priority is driven by the severity and the ubiquity of Windows, not by observed attacks. Given that Microsoft self-reported and shipped a fix, and that PDF-parsing RCEs are attractive for phishing and drive-by delivery, defenders should treat this as a high-priority patch even absent exploitation signals, and even a mid-sized municipal IT team in radom should schedule it in the current cycle rather than deferring. Net: real priority because of blast radius and RCE impact, tempered by the absence of KEV/POC/EPSS corroboration.

An attacker emails or hosts a crafted PDF whose internal length fields are set to trigger the integer wraparound; when a Windows host renders it - via preview pane, thumbnail generation, or a browser/app that uses the Windows PDF runtime - the undersized heap allocation overflows and the attacker's shellcode executes in the rendering process. No credentials are required per the CVSS vector, so a single delivered document can compromise the target; no public exploit is known at time of analysis.