PT-2026-87820 · Microsoft · Windows+14

CVE-2026-70586

Published

2026-09-08

Updated

2026-09-11

CVSS v3.1

8.8

High

Vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

🚨 CVE-2026-70586 MS Paint CVSS 8.8. heap buffer overflow.

Microsoft: Remote Code Execution also Microsoft: victim opens your file

so the kill chain is email a doodle, they open it in Paint to "fix one letter", code runs.

we hardened the kernel for a decade. Paint still eats files like it is 1995.

#CVE #InfoSec #ExploitDev

Fix

RCE

Heap Based Buffer Overflow

Found an issue in the description? Have something to add? Feel free to write us 👾

CVE-2026-70586

Windows

Windows 10 Version 1607

Windows 10 Version 1809

Windows 10 Version 21H2

Windows 10 Version 22H2

Windows 11 Version 23H2

Windows 11 Version 24H2

Windows 11 Version 25H2

Windows 11 Version 26H1

Windows Server 2012

Windows Server 2012 R2

Windows Server 2016

Windows Server 2019

Windows Server 2022

Windows Server 2025