Remote code execution vulnerability in Microsoft Paint

Paint usually brings drawing and cropping screenshots to mind, rather than security vulnerabilities. This time Microsoft has published a remote code execution flaw in it: CVE-2026-83844. It is being discussed again, but it is not a disclosure from today. The CVE record was published on October 13, 2026.

What happened in Paint?

Microsoft’s description is brief: an out-of-bounds read in Paint can allow an unauthorized attacker to execute code over a network. The affected range starts at 11.0.0.0 and ends before 11.2605.91.0, the version marking the fix. Its CVSS 3.1 score is 8.1 — high.

The assessment lists no required user interaction or prior privileges, but high attack complexity. That describes a serious flaw. It does not establish that every internet-connected copy of Paint can simply be taken over. The CVE description I checked does not explain the file format or chain of operations involved. Microsoft’s security advisory is the main reference for this vulnerability.

What is an out-of-bounds read?

A program’s data occupies a defined region of memory. Reading before or after that region means accessing memory that does not belong to that data. That is the weakness described by CWE-125.

These bugs can crash a program or expose information from memory. They can also make another vulnerability easier to exploit. But an out-of-bounds read does not automatically mean code execution. Microsoft classifies this Paint flaw as remote code execution; the short CVE description does not lay out the technical steps leading to it.

An image file is more than the pixels we see on screen. To open it, software has to process its structures, lengths and other fields. Paint’s simple interface does not mean all the code behind it is simple too. That is a general observation, not a claim that we know the precise image-processing path affected here.

If you use Paint

Check Microsoft Store for a Paint update and check the application’s version. If it is within the affected range, it needs updating. Having an up-to-date Windows installation is no reason to skip checking Paint itself.

The part that stands out to me is the application’s name: Paint. Security updates usually bring browsers, servers and operating systems to mind. A drawing app we open occasionally is easy to forget. Its updates deserve attention too.

I have also included the Hacker News discussion below. For affected versions and the technical classification, I used Microsoft’s published record rather than the comments.

Better yet, use the Paint app that doesn’t exist in PckOS yet, and enjoy some peace of mind. 😄