Security · High impactFan score 43 · Tier B57 comments in the community
MS Paint Remote Code Execution Vulnerability
Hacker News: Front Page · By kuberwastaken ·
The Brief
- A remote code execution vulnerability in MS Paint has been disclosed as CVE-2026-83844.
- A commenter says it affects Paint 11.0.0.0 up to, but not including, 11.2605.91.0.
- A commenter says the fix is version 11.2609.401.0.
Why it matters
Developers on Windows who run the affected Microsoft Paint versions should update, since the flaw allows code execution and is reported as remotely exploitable.
Who’s affected
- Windows users running Microsoft Paint 11.0.0.0 up to, but not including, 11.2605.91.0
What to do
- Update Microsoft Paint to version 11.2609.401.0 or later
- If Windows Update does not offer the fix, check the Microsoft Store, as one commenter reported
- MS Paint 11.2609.401.0
- CVE-2026-83844
- #security
- #windows
- #microsoft
- #vulnerability
- #rce
- #paint
What developers are saying
Based on 57 comments · Mixed reactions
Commenters on Hacker News reacted with disbelief and humour, since Paint is an unlikely target for remote code execution. Several questioned the CVSS vector, especially the no-user-interaction flag and the unclear network context. Others noted the fix was hard to get through Windows Update and compared the bug to the recent Notepad CVE.
- Disbelief about remote Paint exploit30%
- Doubts about CVSS vector20%
- Fix hard to obtain15%
- Jokes about Paint and calc20%
- Comparison to Notepad CVE10%
In favour
Concerns
- − The CVSS vector shows no user interaction, which some commenters doubt
- − The network context of the attack is unclear
- − Windows Update did not show the fix for at least one user
“UI:N it is with no interaction ? is it a cve mistake ?”
“Had to go to Microsoft Store to get the fixed version, Windows Update didn't show anything.”
“What Network?”