Microsoft Paint Vulnerability Allows Hackers to Execute Malicious Code Remotely Without User Interaction

Microsoft has announced a vulnerability in Windows Paint that could let unauthenticated attackers execute malicious code remotely without any user interaction. This vulnerability is tracked as CVE-2026-83844 and was disclosed on October 13, 2026.

It carries an “Important” severity rating from Microsoft, and its CVSS 3.1 base score is 8.1, indicating potentially serious consequences, despite the high complexity involved in successfully exploiting it.

According to Microsoft’s security advisory, the vulnerability originates from an out-of-bounds read, classified as CWE-125. This memory-safety weakness occurs when software reads data before the start of an intended buffer or beyond its end. Such errors can expose sensitive memory, crash applications, or help attackers bypass protections when combined with other exploitation techniques.

Microsoft Paint Vulnerability

Microsoft states that an attacker could exploit the vulnerability by sending a specially crafted…