High-Severity Vulnerability Found in Windows' Built-In Paint; Crafted Images Could Enable ...

A vulnerability that could allow remote code execution has been confirmed in Paint, the drawing app bundled with Microsoft's Windows operating system. The Common Vulnerabilities and Exposures identifier is CVE-2026-83844, with a severity score of 8.1, classified as "High." Affected versions range from 11.0.0.0 to 11.2605.91.0, with the latest affected version released on June 12, 2026.

The flaw is an "out-of-bounds read," in which the app reads beyond the intended bounds of memory while processing an image. By exploiting this defect, an unauthenticated attacker could send a crafted packet over the network and potentially run arbitrary code on an affected device.

The Paint version can be checked by clicking the gear icon in the upper-right corner of the app screen. Regarding how to obtain the patched version, developers in the community have noted that it did not appear in Windows Update and had to be downloaded from the Microsoft Store.

What has drawn attention in this case is less the hassle of patching than a design question: why does a simple drawing app have a path for remote code execution? On Hacker News, some commenters said they could see no reason why Paint would make a convenient entry point for attackers, while others sarcastically suggested the vulnerability was created to push users toward the app store. Some also saw it as an operational judgment backfiring—the long-standing decision to leave Paint alone on the grounds that it was harmless.

Microsoft has in recent years made clear its priority on raising the performance and reliability of Windows. According to the company, recent optimizations improved Windows 11 responsiveness by up to 20% and multitasking performance by up to 40% on machines with 8GB of memory. These improvements are available on supported systems without waiting for a future major update.

For the major update, expected to be called "Windows 11 27H2," there is a view that it is planned as a comprehensive refresh that replaces core components rather than merely enabling existing features. It would be the largest such update since 24H2 in 2024, and could increase the burden of compatibility testing. Experimental support for Intel's "Advanced Performance Extensions (APX)," which doubles the number of general-purpose CPU registers from 16 to 32, has been confirmed in some builds, but inclusion in 27H2 has not been officially announced.

Note: The upper bound of affected versions is the release distributed on June 12, 2026. The patched version appears to be distributed through the Microsoft Store.

For corporate IT departments, the fact that the update channel for a built-in app does not match OS updates is a practical blind spot. Organizations that do not list the Paint version in their asset management records may be slow to confirm whether it has been patched. While out-of-bounds read flaws are unlikely to lead directly to information leaks, the impact of exploitation as a foothold for an attack extends to the scope of the device's privileges.

Microsoft has published detailed technical information and guidance on the update program in its security update guide. Even in environments where Paint is not used for business, it cannot be excluded because it is built in, and organizations are advised to check distribution status.