Vulnerability · high
MS Paint Remote Code Execution Vulnerability Disclosed
Tier B · Patch this week – Put it in the sprint
Who’s exposed: Paint 11.0.0.0 up to but excluding 11.2605.91.0
Tier B because: Full takeover OR secrets exposed OR supply chain
Reach
Attack
Damage
Fix
Full takeover
The Brief
- A remote code execution vulnerability in MS Paint has been disclosed as CVE-2026-83844.
- A commenter says it affects Paint 11.0.0.0 up to, but not including, 11.2605.91.0.
- A commenter says the fix is version 11.2609.401.0.
Why it matters
Developers on Windows who run the affected Microsoft Paint versions should update, since the flaw allows code execution and is reported as remotely exploitable.
The checklist behind the tier
Checklist · 2 of 10 yes
| Yes | Hits tech teams | Bundled in Windows, an OS that developers and IT teams run and manage |
| No | Core infrastructure | A single bundled image editor, not software nearly every team runs |
| No | Popular tool | Bundled consumer image editor, not a framework or developer tool |
| No | Exploited in the wild | Hacker News title reports only a disclosed vulnerability, no observed attacks |
| No | Public exploit | Hacker News lists no summary or exploit details, only a CVE link |
| No | Remote, no login | Hacker News does not state that no credentials or interaction are needed |
| Yes | Full takeover | Hacker News: title describes a Remote Code Execution vulnerability |
| No | Secrets exposed | No source reports credentials, data or secrets being stolen or exposed |
| No | Supply chain | No source reports malicious code shipped through a trusted channel |
| No | No fix yet | No source states whether a patched version is available or missing |
Timeline
Source
MS Paint Remote Code Execution Vulnerability ↗ Hacker News: Front Page · 16h ago
What developers are saying
Based on 57 comments · Mixed reactions
Commenters on Hacker News reacted with disbelief and humour, since Paint is an unlikely target for remote code execution. Several questioned the CVSS vector, especially the no-user-interaction flag and the unclear network context. Others noted the fix was hard to get through Windows Update and compared the bug to the recent Notepad CVE.
- Disbelief about remote Paint exploit30%
- Doubts about CVSS vector20%
- Fix hard to obtain15%
- Jokes about Paint and calc20%
- Comparison to Notepad CVE10%
In favour
Concerns
- − The CVSS vector shows no user interaction, which some commenters doubt
- − The network context of the attack is unclear
- − Windows Update did not show the fix for at least one user
“UI:N it is with no interaction ? is it a cve mistake ?”
“Had to go to Microsoft Store to get the fixed version, Windows Update didn't show anything.”
“What Network?”
First seen · 1 source · 57 comments · Full story page · How tiers are decided