CVE-2026-32183
Received Received - Intake
Command Injection in Windows Snipping Tool Enables Local Code Execution

Publication date: 2026-04-14

Last updated on: 2026-04-20

Assigner: Microsoft Corporation

Description
Improper neutralization of special elements used in a command ('command injection') in Windows Snipping Tool allows an unauthorized attacker to execute code locally.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-14
Last Modified
2026-04-20
Generated
2026-05-07
AI Q&A
2026-04-15
EPSS Evaluated
2026-05-05
NVD
EUVD
Affected Vendors & Products
Showing 25 associated CPEs
Vendor Product Version / Range
microsoft windows_server_2012 r2
microsoft windows_server_2012 *
microsoft windows_10_1607 to 10.0.14393.9060 (exc)
microsoft windows_10_1607 to 10.0.14393.9060 (exc)
microsoft windows_10_1809 to 10.0.17763.8644 (exc)
microsoft windows_10_1809 to 10.0.17763.8644 (exc)
microsoft windows_10_21h2 to 10.0.19044.7184 (exc)
microsoft windows_10_21h2 to 10.0.19044.7184 (exc)
microsoft windows_10_21h2 to 10.0.19044.7184 (exc)
microsoft windows_10_22h2 to 10.0.19045.7184 (exc)
microsoft windows_10_22h2 to 10.0.19045.7184 (exc)
microsoft windows_10_22h2 to 10.0.19045.7184 (exc)
microsoft windows_11_23h2 to 10.0.22631.6936 (exc)
microsoft windows_11_23h2 to 10.0.22631.6936 (exc)
microsoft windows_11_24h2 to 10.0.26100.8246 (exc)
microsoft windows_11_24h2 to 10.0.26100.8246 (exc)
microsoft windows_11_25h2 to 10.0.26200.8246 (exc)
microsoft windows_11_25h2 to 10.0.26200.8246 (exc)
microsoft windows_11_26h1 to 10.0.28000.1836 (exc)
microsoft windows_11_26h1 to 10.0.28000.1836 (exc)
microsoft windows_server_2016 to 10.0.14393.9060 (exc)
microsoft windows_server_2019 to 10.0.17763.8644 (exc)
microsoft windows_server_2022 to 10.0.20348.5020 (exc)
microsoft windows_server_2022_23h2 to 10.0.25398.2274 (exc)
microsoft windows_server_2025 to 10.0.26100.32690 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?

To mitigate this vulnerability, it is recommended to apply the security updates provided by Microsoft for the Windows Snipping Tool as soon as they become available.

Additionally, limiting user privileges and avoiding running the Snipping Tool with elevated permissions can reduce the risk of exploitation.


Can you explain this vulnerability to me?

This vulnerability is a command injection flaw in the Windows Snipping Tool. It occurs because the tool improperly neutralizes special elements used in commands, allowing an unauthorized attacker to execute code locally on the affected system.


How can this vulnerability impact me? :

An attacker exploiting this vulnerability can execute arbitrary code on the local machine without proper authorization. This can lead to full compromise of confidentiality, integrity, and availability of the affected system.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart