Even Microsoft Paint is being targeted by cyberattackers — update now or face the consequences
There's a way to execute malicious code remotely through Paint but a patch is available.
Microsoft has patched a high-severity vulnerability in Paint that could allow remote code execution through crafted image files. This security flaw, tracked as CVE-2026-83844, is described as an "out-of-bounds read" which could enable an unauthorized attacker to execute malicious code over a network. Microsoft fixed the issue with version 11.2605.91.0, but for some users, the patched version remains unavailable on the Microsoft Store.
The vulnerability scored 8.1/10 (high) on the National Vulnerability Database and is categorized as "Network, with no privileges required", meaning threat actors with previously obtained low-privilege access could exploit this flaw to escalate their privileges and deploy dangerous malware, leading to credential theft, wire fraud, or ransomware attacks.
However, there are no confirmed cases of in-the-wild exploitation or publicly available exploit code. Microsoft users should verify their Paint version via PowerShell and update to the latest version, 11.2609.401.0, from the Microsoft Store.
Written by urgent.news from TechRadar's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
