Microsoft’s Windows Paint vulnerability, CVE-2026-83844, could allow an unauthenticated attacker to execute code over a network without user interaction.

Microsoft’s Windows Paint vulnerability, CVE-2026-83844, could allow an unauthenticated attacker to execute code over a network without user interaction. The flaw carries a CVSS score of 8.1, placing it in the High severity category rather than Critical. However, confusion over the corrected Paint version has complicated patch checks for Windows administrators. The vulnerability stems from an out-of-bounds read, a memory error in which software reads beyond its intended boundary. Microsoft published the advisory on October 13, 2026. Its assessment lists a network attack vector, no required privileges, and high attack complexity, meaning successful exploitation depends on conditions that make an attack harder to carry out. Windows 0-Click Paint RCE Vulnerability The disclosure formed part of the October update cycle, covered in Cybersecurity News’ Microsoft October Patch Tuesday report . For administrators, the immediate concern is not simply whether an update exists, but whether the corrected application build has actually reached managed devices. Microsoft initially listed Paint version 11.2605.91.0 as the fixed release. Administrators reported that Microsoft Store continued offering 11.2605.81.0, even after update checks and Store cache resets. Microsoft’s advisory listed 11.2609.401.0 as the fix, suggesting the earlier version reference may have been incorrect. Microsoft has not confirmed that explanation. Update availability also appears inconsistent. Some administrators reported difficulty obtaining a corrected build, while one participant in the Reddit discussion said the update had become available through Microsoft Store. These individual reports do not establish a universal rollout status. Claims that availability depends on region also remain unverified. A crafted image could trigger the flaw, but Microsoft’s quoted guidance describes a crafted network packet sent to an affected service. The Hacker News discussion highlights the missing detail: neither the exposed service nor the complete attack path is identified. Suggestions involving Copilot or other components are speculation. Administrators should check the installed Paint version rather than trust an “up to date” message alone. Neowin recommends following Microsoft’s current advisory and considering temporary removal where Paint is unnecessary. Restricting untrusted images may reduce general exposure, but it is not a confirmed fix for this specific network attack path. Cybersecurity News’ separate PNG vulnerability coverage provides related context on image software security. Those flaws are separate from this Paint vulnerability. Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs . The post Microsoft Paint 0-Click Vulnerability Could Allow Hackers to Take Control of Windows PCs appeared first on Cyber Security News .

windows desktop software for adults that plays user-configured visual overlays, audio, and interactive sessions on the user's own computer.

Microsoft’s Windows Paint vulnerability, CVE-2026-83844, could allow an unauthenticated attacker to execute code over a network without user interaction. The flaw carries a CVSS score of 8.1, placing…

User manual for obsidian-logging, a CLI for logging to Obsidian daily notes

Encrypted command-line manager for notes, URLs, and secrets.

Microsoft confirms Windows 11 26H2 to finally fix a long-standing user annoyance after over 30 years of the feature's existence.