WORLDTECHMicrosoft patches high-severity Paint flaw that could allow code to be run remotely
Microsoft has released a security update for its Paint application to fix a high-severity vulnerability that could let an attacker run code on a machine remotely, according to a report by Tech Radar. The flaw is tracked as CVE-2026-83844 and carries a severity score of 8.1.
Details of the flaw
The vulnerability is an out-of-bounds read flaw. According to the reporting, an attacker could try to exploit it by crafting a malicious image file that triggers code execution when opened in Paint.
Microsoft noted that the attack requires no privileges but that its complexity is high, which would likely restrict exploitation to sophisticated actors. The reporting says the flaw could expose users to credential theft, wire fraud and ransomware deployment.
Updates now arrive through the Microsoft Store
Paint is now a standalone application, so its updates are delivered through the Microsoft Store rather than the standard Windows Update process. The reporting says this change has caused confusion, with some users saying they stayed on vulnerable versions despite checking for updates.
The patch appears to be rolling out in stages. Users are advised to confirm their installed version, with version 11.2605.91.0 or later being the fixed release, using PowerShell and to watch the Microsoft Store for the latest update.
Open questions
- How many users remained on vulnerable versions after the staggered rollout?
- Has the flaw been exploited in attacks so far?