CVE-2026-32183
Published: 14 April 2026
Summary
CVE-2026-32183 is a high-severity Command Injection (CWE-77) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 19.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-32183 is a command injection vulnerability (CWE-77) affecting the Windows Snipping Tool. Published on 2026-04-14, it arises from improper neutralization of special elements used in a command, allowing an unauthorized attacker to execute code locally. The issue carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
An attacker with local access can exploit this vulnerability through low-complexity attacks that require user interaction but no special privileges. By tricking a user into performing an action within the Snipping Tool—such as processing a specially crafted input—the attacker can achieve arbitrary code execution on the local system, resulting in high impacts to confidentiality, integrity, and availability.
Microsoft's update guide provides details on mitigation, available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32183.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-22564
Vulnerability details
Improper neutralization of special elements used in a command ('command injection') in Windows Snipping Tool allows an unauthorized attacker to execute code locally.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection (CWE-77) in Windows client app (Snipping Tool) enables local arbitrary code execution via crafted user-opened input, directly mapping to T1203 (Exploitation for Client Execution) and T1059.003 (Windows Command Shell) for injected command execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates this CVE by requiring timely identification, reporting, and patching of the command injection flaw in Windows Snipping Tool.
Prevents exploitation by enforcing validation of inputs to neutralize special elements used in commands within the Snipping Tool.
Reduces impact of arbitrary code execution from command injection via runtime memory protection safeguards.