# CVE-2026-32225 — Windows Shell `shell32.dll` Missing Trust Verification on Control Panel Applet Launch → Security Feature Bypass

---

## Summary

| | |
|---|---|
| **Product** | Windows — `shell32.dll` (Windows Shell; Control Panel folder) |
| **CVE ID** | CVE-2026-32225 |
| **Impact** | Security Feature Bypass |
| **MSRC severity** | Important |
| **CVSS** | 7.8 / 6.8 — `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C` |
| **CWE** | CWE-693: Protection Mechanism Failure |
| **Delivery** | Local — invoking a crafted/untrusted Control Panel applet via the shell |
| **KB / Fixed build** | KB5083769 — `shell32.dll` 10.0.26100.8246 (Win11 24H2 x64) |
| **Patch Date** | April 14, 2026 (2026-Apr) |
| **Pre-patch binary** | `shell32.dll` 10.0.26100.8115 — SHA256 `de0b8849c41d7f60a4a46f9c0f1e5e49db37be9720b169cdf08e88d3c273c21a` |
| **Post-patch binary** | `shell32.dll` 10.0.26100.8246 — SHA256 `31bfc50a35c706e86fba537665c5e0700f162fdd308d2a0b2e3bc58fad48a72c` |
| **Feature flag** | `Feature_485165370` / `Feature_1431563577` — **CFR-gated** |
| **Exploitability** | Exploitation Less Likely; not publicly disclosed; not exploited (per MSRC) |

> Scope note: this April `shell32.dll` update remediated **several** related Windows
> Shell CVEs in the same Control Panel launch cluster (CVE-2026-26165 / 26166 / 27918
> memory-safety, CVE-2026-32151 info-disclosure). This analysis covers the isolable
> **trust-verification** change, which is the mechanism for CVE-2026-32225; the
> per-CVE split of the memory-safety / info-disclosure issues is not derivable from
> the binary diff alone and is not claimed here.

---

## Product Description

`shell32.dll` implements the Windows Shell, including the Control Panel folder. When
the shell invokes a Control Panel applet or task, the folder callbacks
`CControlPanelFolder::CallBack` and `CTasksFolder::CallBack` resolve the applet from
its PIDL and launch it (`_ShellExecCplApplet` / `CControlPanelTasks::ExecuteTask` /
`CPL_LaunchRunDLLProcess`).

---

## Vulnerability Summary

Pre-patch, the Control Panel folder callbacks launched the resolved applet **without
verifying its trust** — there was no trust/verification query before executing the
applet. A crafted or untrusted Control Panel applet (for example one not properly
package-trusted, or lacking the expected Mark-of-the-Web / zone protection) could
therefore be launched through the shell, **bypassing the intended protection
mechanism** (CWE-693).

---

## Prerequisites and Constraints

- Local (`AV:L`, `PR:L`): get the shell to invoke a crafted/untrusted Control Panel
  applet (e.g. via a prepared item in the Control Panel namespace / a task).
- Result: the applet is launched without the trust check the protection mechanism was
  meant to enforce.

---

## Vulnerability Details

### Root Cause

The Control Panel applet launch path did not query the applet's trust before
executing it, so the protection mechanism intended to block untrusted applets was not
enforced.

### The patch (confirmed — diff, .8115 → .8246)

Gated behind `Feature_485165370` / `Feature_1431563577`, the folder callbacks now
validate the item, resolve its executable name, and **query the `IVerifyingTrust`
service before launching**, and the task path carries the site into the launch:

```c
// CControlPanelFolder::CallBack (10.0.26100.8246) — PATCHED (from the diff)
p_Var9 = _IsValid((_ITEMIDLIST_RELATIVE *)param_3);
if (p_Var9) {
    GetExecName(p_Var9, false, local_878, 0x20b);
    IUnknown_QueryService(*(IUnknown **)(param_6 + 0x20),
                          &IID_IVerifyingTrust, &IID_IObjectWithPackageFullName, &obj);  // *** trust check ***
}

// CTasksFolder::CallBack — IUnknown_QueryService(*(this+0x28), &IID_IVerifyingTrust, ...)
// CControlPanelTasks::ExecuteTask — ShellExecCmdLine(...) -> ShellExecCmdLineWithSite(...)  // site/trust flows in
```

By querying `IVerifyingTrust` (yielding an `IObjectWithPackageFullName`) before
launch, and threading the site through `ShellExecCmdLineWithSite`, the shell now
verifies the applet's trust and blocks untrusted applets, restoring the protection
mechanism.

### Patch Completeness Assessment

**CFR-gated behind `Feature_485165370` / `Feature_1431563577`.** The trust
verification runs only when the flags are enabled; the original no-verification launch
still ships when disabled. Verify the flags are enabled to confirm the fix is live.

---

## Detection Guidance

**Behavioural.** Control Panel applet launches originating from untrusted locations /
crafted namespace items; execution of `.cpl` applets without a valid trust/package
context. On unpatched/flag-disabled builds the shell will launch such applets without
the `IVerifyingTrust` check.

**Config.** The fix is CFR-gated — confirm `Feature_485165370` / `Feature_1431563577`
are enabled.

---

## References

- MSRC advisory — CVE-2026-32225 (Windows Shell Security Feature Bypass), released 2026-04-14, KB5083769.
- Full binary diff: `/data/patch_diffs/shell32_dll-cve-2026-32225-ghidriff.md`
- Related same-update Windows Shell CVEs (same Control Panel launch cluster): CVE-2026-26165, CVE-2026-26166, CVE-2026-27918, CVE-2026-32151.