The vulnerability carries a CVSS base score of 7.8 and a temporal score of 6.8. Its full vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C, indicating local access, low attack complexity, no required privileges, and required user interaction. A successful attack can affect confidentiality, integrity, and availability at high impact.
Microsoft’s stated consequence is unusually clear: an attacker who successfully exploits the flaw could gain SYSTEM privileges. That makes this an elevation-of-privilege issue worth treating as a host-compromise multiplier, rather than a remote initial-access vulnerability. An attacker must already have a way to execute or induce activity on the affected machine, but successful escalation can turn a limited foothold into control at the Windows SYSTEM level.
The weakness is an integer-overflow condition
CVE-2026-58641 is categorized as CWE-190, Integer Overflow or Wraparound. These flaws arise when arithmetic produces a value outside the permitted range of its storage type and the application handles the resulting wrapped value incorrectly.
In this case, Microsoft identifies the affected product as SkiaSharp 4.151.2. SkiaSharp is the .NET binding for Skia-based graphics functionality, so the issue is relevant to applications that package or depend on that component—not simply to every Windows device with the .NET runtime installed.
The advisory’s CVSS vector also includes UI:R: user interaction is required. Administrators should therefore consider application workflows that process locally supplied or user-selected content, as well as delivery routes that could persuade a user to open or interact with attacker-controlled material. Microsoft does not describe a specific trigger condition in the supplied advisory details.
Microsoft’s affected-product record and remedy
Microsoft maps CVE-2026-58641 to the following product and fixed build:
| Affected product | KB-to-build mapping | Vendor fixed version |
|---|---|---|
| SkiaSharp 4.151.2 | Fixed build 4.151.2 | 4.151.2 or later |
The remediation value from Microsoft is: “For SkiaSharp 4.151.2, update to fixed build 4.151.2 or later.”
The affected-product record supplies a fixed-build mapping rather than a Windows cumulative-update KB identifier. For IT teams, that changes the patching path: this should be handled through dependency and application update processes for deployments using SkiaSharp, rather than assumed to be resolved by ordinary Windows Update servicing alone.
Microsoft labels the case Customer action required: Yes. Organizations should identify applications, internal services, desktop deployments, build pipelines, and packaged workloads that include SkiaSharp 4.151.2, then ensure their deployed component is at fixed build 4.151.2 or later.
Disclosure and exploitation status
Microsoft records the following status for CVE-2026-58641:
- Publicly disclosed: No
- Exploited: No
Microsoft’s exploitation assessment is Exploitation Less Likely. That assessment should guide prioritization, but it does not remove the need to remediate: the documented impact is SYSTEM-level privilege escalation, and the advisory assigns high confidentiality, integrity, and availability impacts following successful exploitation.
Teams should inventory their .NET dependency manifests and deployed application artifacts for SkiaSharp 4.151.2, update to fixed build 4.151.2 or later, rebuild affected applications where necessary, and validate that the updated dependency reaches production endpoints.