An improper neutralization of special elements in the Windows Snipping Tool allows an attacker to inject arbitrary commands. The vulnerability is a command‑injection weakness that can enable execution of arbitrary code on the affected system, potentially leading to elevated privileges or takeover of the targeted machine. The weakness corresponds to CWE‑77, which deals with command injection flaws.

The flaw affects Microsoft Windows 10 from version 1607 through 22H2, Microsoft Windows 11 from version 23H2 through 26H1, and various Windows Server editions including Server 2012, 2012 R2, 2016, 2019, 2022, and 2025. Both x64 and arm64 architectures are impacted, as are 32‑bit builds of older Windows 10 releases.

The CVSS score of 7.8 labels the vulnerability as a high‑severity flaw. No EPSS value is provided, and the issue is not listed in the CISA KEV catalog, suggesting limited public exploitation data. The description indicates that exploitation is local; an attacker must be able to run an untrusted input in the Snipping Tool environment to trigger the command injection. Although the exact requirements for successful exploitation are not detailed, the high severity combined with local applicability means that any user with access to the tool represents a valid risk.