CVE-2026-70586 – Windows Paint Remote Code Execution Vulnerability

CVE-2026-70586 is a critical remote code execution vulnerability caused by a heap-based buffer overflow in Windows Paint. An unauthorized attacker can trigger the vulnerability by convincing a user to open a specially crafted file. The attack requires no privileges but does require user interaction. Successful exploitation can execute code and has a high potential impact on confidentiality, integrity, and availability.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: The vulnerability has a network attack vector, low attack complexity, and requires no attacker privileges. User interaction is required because the targeted user must open a specially crafted file. Successful exploitation could allow unauthorized code execution with high confidentiality, integrity, and availability impact.

EXPLOITS: The vulnerability is assessed as Exploitation Unlikely. It is not publicly disclosed and is not known to be exploited. Exploit code maturity is listed as Unproven, so the source does not confirm a public exploit, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: CVE-2026-70586 is a heap-based buffer overflow (CWE-122) affecting Windows Paint. The flaw can be triggered when a user opens a specially crafted attacker-controlled file. The vulnerability has network attack vector characteristics, low attack complexity, requires no privileges, and requires user interaction. Successful exploitation enables remote code execution and can result in high impact to the confidentiality, integrity, and availability of the affected system. An official fix is identified for this vulnerability.

EXPLOITABILITY: Affected software includes Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including the listed Server Core installations and applicable architectures. Exploitation requires a user to open a specially crafted file.

BUSINESS IMPACT: Successful exploitation could allow an unauthorized attacker to execute code on an affected system, potentially compromising sensitive information, altering data, or disrupting system availability. Because no attacker privileges are required and the technical impact is high across confidentiality, integrity, and availability, a successful attack could create significant operational and security consequences.

WORKAROUND: No mitigations or workarounds are identified. An official fix is listed, so affected systems should be updated through the applicable security patch where possible.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.8 and can lead to remote code execution. Although exploitation is assessed as unlikely and no active exploitation is identified, the low attack complexity, lack of required privileges, and high confidentiality, integrity, and availability impacts make timely deployment important.