Cyber & AI intelligence
Wasteland.
Briefs indexed2597
Issues28
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-69586 2026-09-08

CVE-2026-69586: Critical Integer Overflow in Windows PDF Enables Unauthenticated Remote Code Execution

"Microsoft has disclosed a CVSS 9.8 integer overflow in the Windows PDF component that lets an unauthorized attacker execute code over a network with no privileges and no user interaction."

Microsoft has disclosed a CVSS 9.8 integer overflow in the Windows PDF component that lets an unauthorized attacker execute code over a network with no privileges and no user interaction.

What Is It

CVE-2026-69586 is an integer overflow or wraparound condition in Microsoft Windows PDF. According to Microsoft's advisory, the flaw "allows an unauthorized attacker to execute code over a network." The CVE is classified under CWE-190 (Integer Overflow or Wraparound) and CWE-122 (Heap-based Buffer Overflow). The pairing of those two weakness classes suggests the arithmetic wraparound produces an undersized heap allocation that is subsequently overflowed, though Microsoft has not published technical detail confirming the exploitation path.

The CVSS 3.1 base score is 9.8 (CRITICAL), vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network attack vector, low attack complexity, no privileges required, no user interaction, with high impact to confidentiality, integrity, and availability. The exploitability subscore is the maximum 3.9.

Why It Matters

The combination of no authentication, no user interaction, and network reachability puts this in the rare tier of bugs that require nothing from the victim. The high ratings across confidentiality, integrity, and availability mean the scoring anticipates a full-compromise outcome rather than a partial-disclosure one; the metrics describe the assessed impact ceiling, not an observed intrusion.

Exploitation status is not established at the time of writing: Microsoft's advisory does not report observed in-the-wild attacks, and no public exploitation reporting was identified for this brief. Catalog and exploitation status can change quickly, so defenders should check the CISA Known Exploited Vulnerabilities catalog directly for the current listing and any associated remediation deadline rather than relying on this brief. The NVD record status is "Awaiting Analysis," meaning NVD has not yet completed its own enrichment.

What's Vulnerable

Microsoft lists a broad swath of supported Windows builds as affected, on 32-bit, x64, and ARM64 platforms:

Windows Server 2025 and Windows 11 24H2 are built from the same 10.0.26100 servicing branch and therefore take the same fixed revision.

Patch Status

Fixed builds are published for every affected product listed above; the "less than" build numbers are the patched thresholds. Apply the relevant cumulative update from the Microsoft Security Response Center advisory and verify build numbers meet or exceed the fixed values. Published 2026-09-08.

Sources