High severity · published Apr 14, 2026
CVE-2026-32183
Windows Snipping Tool Remote Code Execution Vulnerability
7.8
CVSS
0.6%
EPSS
No
On KEV
Description
Improper neutralization of special elements used in a command ('command injection') in Windows Snipping Tool allows an unauthorized attacker to execute code locally.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
W1
Windows 10 Version 1607 · Microsoft
10.0.14393.0 before 10.0.14393.9060 · source: vendor
W1
Windows 10 Version 1809 · Microsoft
10.0.17763.0 before 10.0.17763.8644 · source: vendor
W1
Windows 10 Version 21H2 · Microsoft
10.0.19044.0 before 10.0.19044.7184 · source: vendor
W1
Windows 10 Version 22H2 · Microsoft
10.0.19045.0 before 10.0.19045.7184 · source: vendor
W1
Windows 11 Version 24H2 · Microsoft
10.0.26100.0 before 10.0.26100.8246 · source: vendor
W1
Windows 11 Version 25H2 · Microsoft
10.0.26200.0 before 10.0.26200.8246 · source: vendor
W1
Windows 11 version 23H2 · Microsoft
10.0.22631.0 before 10.0.22631.6936; 10.0.22631.0 before 10.0.22631.6936 · source: vendor
W1
Windows 11 version 26H1 · Microsoft
10.0.28000.0 before 10.0.28000.1836 · source: vendor
WS
Windows Server 2012 · Microsoft
6.2.9200.0 before 6.2.9200.26026 · source: vendor, NVD
WS
Windows Server 2012 (Server Core installation) · Microsoft
6.2.9200.0 before 6.2.9200.26026 · source: vendor
WS
Windows Server 2012 R2 · Microsoft
6.3.9600.0 before 6.3.9600.23132 · source: vendor
WS
Windows Server 2012 R2 (Server Core installation) · Microsoft
6.3.9600.0 before 6.3.9600.23132 · source: vendor
In the news
VulnerabilityHigh
ZDI-26-279: Microsoft Windows Snipping Tool Improper Input Validation Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2026-32183.
Apr 15, 2026·Zero Day Initiative
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-32183
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-32183
Vendor Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32183
More from Windows 10 Version 1607
9.8
CVE-2026-33824
Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability
8.8
CVE-2026-96951
Windows Shell Security Feature Bypass Vulnerability
8.8
CVE-2026-21510
Windows Shell Security Feature Bypass Vulnerability
8.8
CVE-2026-21513
MSHTML Framework Security Feature Bypass Vulnerability
8.8
CVE-2025-33073
Windows SMB Client Elevation of Privilege Vulnerability