Windows Paint CVE-2026-70586

Exploitation requires that the victim open a specially crafted image file in Windows Paint - the attacker must deliver the file via any channel (email attachment, web download, SMB/UNC path, USB) and induce the user to open it with Paint specifically. Since Paint handles many default image file-type associations on Windows (BMP, DIP, and others), double-clicking an image file may automatically invoke it without the user consciously choosing Paint. No authentication is required from the attacker. The attack is limited by the UI:R requirement: passive exploitation without user action is not possible. Additionally, exploitation is constrained to the privilege level of the currently logged-on user (S:U, unchanged scope), so a standard-privilege user account limits post-exploitation reach without a separate privilege escalation step. All affected Windows versions use ASLR and heap protections, which raise exploitation complexity in practice beyond the AC:L CVSS metric suggests.

The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) correctly reflects the network-deliverable file-based exploitation model: no authentication and low complexity on the attacker side, with UI:R as the principal limiting factor requiring the victim to open a crafted file. No EPSS score is provided in the input, and this CVE does not appear in the CISA KEV catalog, meaning active exploitation has not been confirmed. No public proof-of-concept code is identified. Despite the absence of confirmed exploitation, the breadth of affected versions - 19 Windows SKUs spanning over a decade of releases - means even a mid-sized municipal IT team in opole should treat this as urgent Patch Tuesday prioritization, given the near-universal Windows deployment footprint and the ease with which image files are socially engineered to victims. The unchanged scope (S:U) limits blast radius to the user running Paint, mitigating lateral movement from this step alone.

An attacker crafts a malicious image file (e.g., a BMP or PNG) containing a heap-triggering payload and delivers it via a phishing email, a malicious website, or a network share with a convincing filename. When the victim double-clicks the file and Windows Paint parses it, the overflow corrupts heap structures, redirecting execution to attacker-controlled code running in the victim's user context. No public proof-of-concept has been identified, but the low attack complexity (AC:L) suggests the overflow is reliably triggerable without fine-grained memory layout knowledge.