Windows Server 2012 EUVD-2026-22564

User interaction required: victim must open attacker-controlled file (image or document) in Windows Snipping Tool. No authentication or special configuration needed beyond default tool installation.

Real-world risk is moderate despite the 7.8 CVSS score. The CVSS vector reveals critical constraints: AV:L (local access required, not remotely exploitable), UI:R (mandatory user interaction), though notably PR:N (no authentication needed once local access exists). The attack complexity is low (AC:L), and successful exploitation grants full system compromise (C:H/I:H/A:H with unchanged scope). However, no public exploit identified at time of analysis and no CISA KEV listing significantly reduce immediate threat. The primary risk scenario involves social engineering attacks where users are tricked into opening malicious screenshot files or specially crafted image documents via email, removable media, or shared folders. The vulnerability's presence across all current Windows platforms (affecting 21 distinct version ranges per EUVD data) creates a large attack surface, but the requirement for local execution and user interaction makes mass exploitation unlikely. Organizations should prioritize patching on systems where users regularly handle untrusted files (email gateways, file servers, isolated browsing environments) over fully controlled enterprise endpoints with restricted user privileges.

Attacker sends crafted image file to target via email. When victim opens the file with Snipping Tool to annotate it, embedded shell metacharacters in the filename or metadata trigger command injection, executing attacker's payload with user privileges.