Even Paint is no longer safe: a dangerous vulnerability has been discovered in the standard Windows app that allows hackers to attack computers
The familiar graphic editor Microsoft Paint has found itself at the center of a major cybersecurity incident. Specialists have discovered a vulnerability that potentially allows attackers to remotely execute malicious code on users' computers. Moreover, this concerns a program that for years was considered one of the most harmless tools in Windows.
The vulnerability has been assigned the identifier CVE-2026-83844 and a severity rating of 8.1 out of 10 on the CVSS scale. This is a high threat level, at which successful exploitation could lead to serious system compromise.
How can hackers use Paint to attack?
The issue is related to a memory handling error — Out-of-bounds Read (reading beyond the permissible memory boundaries).
Such errors occur when an application accesses a memory area that extends beyond the allocated buffer. Under certain conditions, this can create the possibility for arbitrary code execution.
According to the published vulnerability description, an attacker can send a specially crafted network packet to the vulnerable service. A potential attack does not require authorization or direct user involvement.
This is especially important: this is not simply about a malicious image that a user accidentally opened. The exploitation mechanism is described as a network attack, although the specific technical conditions for its implementation require additional knowledge about the target system.
How serious is the threat?
The CVE-2026-83844 vulnerability has been rated 8.1 out of 10. The potential consequences of successful exploitation include:
- remote execution of malicious code;
- gaining access to data on the computer;
- modification of system information;
- disruption of the device's normal operation;
- creating conditions for further development of the attack.
At the same time, Microsoft assesses the likelihood of exploitation as relatively low due to the high complexity of implementing the attack. As of the publication of these materials, there is no confirmed information about mass exploitation of this vulnerability by attackers.
Microsoft has already released a fix: but there is an important nuance
Microsoft has prepared a security update, but its distribution turned out to be not as straightforward as one might have expected.
The fix for Paint is distributed through the Microsoft Store, and not only via standard Windows updates. Therefore, installing the next cumulative update for the operating system does not by itself guarantee that the vulnerable version of Paint will be replaced.
Users are recommended to:
- Open Microsoft Store.
- Go to the "Library" section.
- Click "Get updates".
- Find Microsoft Paint and install the available new version.
- Check the application build number.
The Hacker News identifies 11.2609.401.0 or later as the fixed version.
Paint can be updated through the official Microsoft store:
Why does this story deserve special attention?
Paint is one of the most well-known standard Windows applications. It is used for editing images, creating simple illustrations, preparing screenshots, and performing everyday tasks.
That is precisely why incidents like this show that even familiar software cannot be considered fully secure simply because of its simplicity.
Modern cyberattacks increasingly exploit vulnerabilities in components that users are accustomed to trusting. And the problem is not limited to complex professional programs or unknown software.
In this case, the application at risk is one that is installed on a huge number of computers around the world.
What is the bottom line?
The Microsoft Paint story is another reminder of the need to install security updates in a timely manner. Even if a program is used extremely rarely, having a vulnerable version can create additional risks.
Microsoft has already prepared a fix, so Windows users should check the application version and not delay updating.
Have you ever thought that ordinary Paint could turn out to be a potential entry point for a cyberattack?
