Microsoft fixes remote code execution flaw in Windows Paint

Microsoft has disclosed a remote code execution flaw in Windows Paint, tracked as CVE-2026-83844, with a high CVSS score of 8.1. The vulnerability stems from an out-of-bounds memory read in the app’s data packet and image memory handling (CWE-125). In practice, a remote attacker could trigger arbitrary code execution on a target system by sending a crafted packet to an affected service over the local network.

SecurityOnline[.]info notes that the issue affects all Microsoft Paint builds prior to 11.2609.401.0, and that the flaw could be exploited without user interaction.

Microsoft has released a patch, with the advisory indicating Paint versions prior to 11.2609.401.0 are vulnerable and that the fix is included in Paint 11.2609.401.0. The article lists Patch and Mitigation steps as upgrading via the Microsoft Store to 11.2605.91.0, and notes that enterprise admins can push updates centrally. However, it also states the actual fix is in 11.2609.401.0, and that users should update to that version immediately to stop the read error and prevent memory corruption.

As of the report, there was no evidence of exploitation in the wild, and no public PoC code existed, suggesting real-world attacks were considered unlikely at that time. The piece attributes these findings to Microsoft’s security update guidance and the publication’s own analysis.