Microsoft Paint flaw lets hackers take control remotely
No clicks, no credentials, and potentially serious consequences.
A Microsoft office splattered with paint. Mo photography Berlin via Shutterstock.
Follow us
- Microsoft patched CVE-2026-83844 in Paint, a high-severity flaw that can allow remote code execution.
- Attackers may exploit the bug without user clicks, credentials, or authentication.
- Microsoft says exploitation is less likely because the attack requires detailed system knowledge.
- Users should verify Paint build 11.2609.401.0 instead of assuming Windows Update fixed it.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
Microsoft was forced to address a vulnerability in Microsoft Paint, titled CVE-2026-83844, that allows unauthenticated attackers to execute malicious code remotely.
The vulnerability was put in the high-severity category with a score of 8.1 8.1 CVSS 3.1. Despite this, Microsoft had classed it as "important," which felt a few shades less serious.
Additionally, the flaw was classified as a CWE-125, known as an out-of-bounds read, meaning software accesses memory outside the boundaries of a buffer.
For example, if a program were told to read boxes 1-10, the malicious error exposed potentially sensitive errors in box 11, which could contain sensitive information.
In contrast to standard phishing tactics, attackers can deliver a specially tailored, malicious packet entirely without user interaction or authentication.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
Microsoft rated the complexity level of the attack as high. Because of this, successful exploitation requires highly detailed system knowledge. This is not a rookie move.
Other parameters such as confidentiality, integrity, and availability were also given a high ranking. These mean that the hacker can compromise data, alter system information, or disrupt normal operations on the computer.
One saving grace is that Microsoft ranked exploitation as less likely, with a lack of technical specifics lacking in their advisory. There is no confirmed evidence that attackers have carried out this specific attack yet.
Microsoft Paint has a security vulnerability that could let hackers run malicious code on your PC over a network. The flaw, tracked as CVE-2026-83844, is rated 8.1 (High) and could allow attackers to execute code over a network without permission. Microsoft has published a security advisory and a patch for the issue.
undefined Pirat_Nation 🔴 (@Pirat_Nation) November 5, 2026
Microsoft releases patch
Microsoft identifies Paint build 11.2609.401.0 as the security update, allowing the end user the specifics to cross-reference.
The company is adamant that it is best to verify the new Paint version specifically, rather than assume a general Windows update fixes the problem.
Regular programs like Microsoft Paint can go a long time unnoticed, and are not normally associated with security bugs such as this one.
Microsoft credited an anonymous researcher with flagging the problem through the company's official disclosure channel.
