Microsoft has released a security update to resolve a high-severity vulnerability in the Paint application that could allow remote code execution, based on information published by Tech Radar.
The vulnerability, tracked as CVE-2026-83844, carries a severity score of 8.1 and involves an out-of-bounds read flaw. An attacker could potentially exploit this by crafting a malicious image file that triggers code execution when opened in Paint. While the attack vector requires no privileges, Microsoft noted the complexity is high, likely limiting potential exploitation to sophisticated actors. The flaw poses risks including credential theft, wire fraud and ransomware deployment. Because Paint is now a standalone application, updates are delivered via the Microsoft Store rather than the standard Windows Update process. This transition has caused confusion, with some users reporting they remained on vulnerable versions despite checking for updates. Microsoft appears to be using a staggered release for the patch, version 11.2605.91.0 or later. Users are encouraged to verify their installed version using PowerShell and monitor the Microsoft Store for the latest update. There are currently no confirmed reports of the vulnerability being exploited in the wild, and it is not listed in the Cybersecurity and Infrastructure Security Agency known exploited vulnerabilities catalog.
Source: Tech Radar
