Critical Windows Paint Vulnerability Enables Remote Code Execution Attacks

Microsoft has disclosed a Windows Paint vulnerability that could let an attacker run code remotely without signing in or requiring a user to click anything. Tracked as CVE-2026-83844, the flaw received a CVSS score of 8.1. Despite the headline’s wording, Microsoft officially rates its severity as Important, not Critical.

Published on October 13, 2026, the advisory describes an out-of-bounds read, tracked under CWE-125. This means the program reads memory outside its intended limits. Microsoft says the flaw can lead to remote code execution, with potentially serious effects on data privacy, data integrity, and system availability.

The disclosure came during Microsoft’s October security release. Cybersecurity News’ coverage of the October 2026 Patch Tuesday updates provides broader context on the release and its new risk groups, which help administrators assess related flaws together rather than treating every vulnerability as an isolated issue.

Windows Paint RCE Vulnerability

According to Microsoft, an attacker could send a specially crafted network packet to an affected service. Successful exploitation would allow code execution on the target. The advisory does not identify the service, network port, or complete attack chain, so claims that a malicious image alone triggers this flaw remain unconfirmed.

Although no authentication or user interaction is required, exploitation is complex. Microsoft says attackers need detailed system knowledge, while success depends on the environment, configuration, and security controls.

Microsoft marked exploitation as “Less Likely” and reported no prior public disclosure or known exploitation. Those findings describe its original assessment, not a permanent guarantee.

The current Microsoft security advisory lists Paint build 11.2609.401.0 in its security updates table. However, the NIST vulnerability record lists affected versions below 11.2605.91.0. This mismatch matters because administrators should follow Microsoft’s current update guidance rather than rely solely on the earlier version threshold.

Users should check for Paint updates through the Microsoft Store and verify the installed version afterward. Reports indicate that some systems continued receiving older builds despite update checks. Administrators can inspect the package version with PowerShell using Get-AppxPackage Microsoft.Paint | Select-Object Name, Version, then compare the result against Microsoft’s advisory.

Cybersecurity News’ separate report on PNG memory flaws highlights why image software deserves patch attention, although those issues are unrelated to Paint. For this vulnerability, the priority is confirming that the corrected Paint build reaches each affected device, rather than assuming automatic updates have completed successfully.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Critical Windows Paint Vulnerability Enables Remote Code Execution Attacks appeared first on Cyber Security News.