Home / Technology / Paint's Hidden Danger: Remote Code Execution Flaw Patched
Paint's Hidden Danger: Remote Code Execution Flaw Patched
7 Nov
Summary
- A critical Paint vulnerability allowed remote code execution via crafted image files.
- Microsoft released a fix, but updates were delivered through the Microsoft Store.
- Users must verify their Paint version and install the latest update promptly.
Microsoft has resolved a critical vulnerability in its Paint application that posed a risk of remote code execution. This flaw, identified as CVE-2026-83844, carried a high severity rating of 8.1 out of 10, enabling attackers to execute malicious code over a network by crafting specific image files.
The exploit vector for this vulnerability was classified as 'Network, with no privileges required,' meaning attackers with minimal access could escalate privileges or deploy malware, leading to severe consequences like credential theft or ransomware. However, the complexity to exploit this flaw was rated 'High,' suggesting it might be challenging to leverage, possibly limiting its use to sophisticated actors.
This security update for Paint is distributed through the Microsoft Store, not the standard Windows Update. Users must manually check for and install version 11.2605.91.0 or later. Some users reported receiving an older, vulnerable version even after checking for updates, indicating a possible staggered rollout by Microsoft.
To ensure protection, users should confirm their Paint version using PowerShell command 'Get-AppxPackage Microsoft.Paint | Select-Object Name, Version.' Those on older versions should remain vigilant for the update or consider temporary measures like restricting image attachments or uninstalling Paint.
