Microsoft Paint flaw could let attackers run code over a network

Microsoft disclosed a security flaw in Paint on October 13, 2026, that could allow an attacker to run code on a PC over a network. Microsoft rated the CVE-2026-83844 vulnerability with a severity score of 8.1 out of 10 and classified it as "Important." The company says an attacker could exploit the vulnerability by transmitting a custom data packet to a vulnerable component without requiring user authentication.

Photo: Luan Gjokaj on Unsplash

According to the software maker, exploiting the security issue is challenging, and available data indicates no active attacks in the wild. A fix is included in Paint version 11.2609.401.0 and newer. Because the patch is distributed through the Microsoft Store, installing the October 2026 Windows update does not guarantee the app is updated. Sources note that some users remained on version 11.2603.251.0 even with automatic Store updates enabled.