Critical Windows Paint Vulnerability Enables Remote Code Execution Attacks

What happened?

Microsoft has disclosed a Windows Paint vulnerability that could let an attacker run code remotely without signing in or requiring a user to click anything. Tracked as CVE-2026-83844, the flaw received a CVSS score of 8.1. Despite the headline’s wording, Microsoft officially rates its severity as Important, not Critical. Published on October 13, 2026, the advisory describes an out-of-bounds read, tracked under CWE-125. This means the program reads memory outside its intended limits.

Key details

• Windows Paint flaw allows remote code execution via crafted network packet without authentication or user interaction.
• Microsoft rates severity as Important despite headline claiming Critical.
• Version mismatch between Microsoft advisory (11.2609.401.0) and NIST record (below 11.2605.91.0).

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.