Windows Paint Carries a High Severity Remote Code Execution Flaw
Microsoft's Paint app has a remote code execution vulnerability tracked as CVE-2026-83844, scored 8.1 and rated High. Affected versions run from 11.0.0.0 through 11.2605.91.0, the latter released on June 12, 2026.
1 source 51m ago
Reporting from 1 source: GIGAZINE.
Why it matters
A drawing app that most users treat as harmless now sits on the same patch cycle as the rest of Windows, and the fix arrived through the Microsoft Store rather than Windows Update for at least some users.
Key Facts
- CVE-2026-83844 is a remote code execution vulnerability in Microsoft's Paint app, scored 8.1 and rated High.
- Affected Paint versions run from 11.0.0.0 to 11.2605.91.0.
- Version 11.2605.91.0 was released on June 12, 2026.
- The flaw is an out-of-bounds read that occurs when Paint processes images.
- An unauthenticated attacker could exploit the vulnerability by sending a crafted packet over the network.
The flaw is an out-of-bounds read that lets Paint read past its intended memory range while processing images, and an unauthenticated attacker could exploit it by sending a crafted packet over the network.
The vulnerability is an out-of-bounds read. Paint reads beyond its intended range in memory when it processes images, and the CVE entry puts the score at 8.1 with High severity. The affected range spans 11.0.0.0 to 11.2605.91.0, and that last build shipped on June 12, 2026.
Users on Hacker News reported that the fixed build came through the Microsoft Store, with nothing appearing in Windows Update. Others questioned why a drawing program accepts network input at all, since the description describes an unauthenticated attacker sending a crafted packet to an affected service.
Written with AI by Yomimono from the 1 cited source below, including Japanese-language reporting where cited. See our editorial policy.
Add Yomimono as a preferred source on Google
Sources
- GIGAZINE なぜかWindowsの「ペイント」にリモートコード実行の脆弱性