Microsoft has confirmed a remote code execution flaw tracked as CVE-2026-83844 that affects Paint, the long-standing drawing app built into Windows. This Microsoft Paint vulnerability is serious enough to let an attacker take control of a victim’s machine, and Microsoft notes that the fix isn’t a simple matter of flipping a setting.
Here’s what you need to know about the flaw, who it affects, and how to protect yourself.
- Status: Confirmed by Microsoft
- Affected software: Microsoft Paint on Windows 11
- Vulnerability: CVE-2026-83844 — remote code execution
- Workaround: No simple workaround; install Microsoft’s update
What is the Microsoft Paint vulnerability?
Remote code execution (RCE) is one of the most dangerous classes of software bugs. When a program has an RCE flaw, a malicious input can cause the program to run arbitrary code that the attacker controls — rather than just doing what the user asked.
In this case, the flaw lives in Paint. Paint is designed to open and render image files, so the vulnerability is almost certainly tied to how the app processes a crafted image. If an attacker can get Paint to open a specially engineered file, the flaw could let them execute code with the same permissions as the current user.
From a practical standpoint, that means the attacker could potentially install programs, view, change, or delete data, or set up an account with full user rights — all without you touching the keyboard.
How would an attacker exploit it?
The Neowin report describes the flaw as something that lets hackers compromise Windows 11 PCs “over the internet.” That phrasing points to a remote-exploitation vector, which is what makes RCE vulnerabilities in everyday apps so concerning.
In practice, exploiting a Paint-based RCE typically requires the victim to interact with a malicious file in some way. The most common path is social engineering: an attacker emails or messages a look-legitimate image, and once you open it in Paint, the code runs. Some image-parser flaws are even worse — they can be triggered automatically when File Explorer generates a thumbnail preview, meaning merely browsing to a folder containing the bad file could be enough.
Microsoft hasn’t published detailed exploit specifics in the summary available so far, so exactly how much interaction an attacker needs remains unclear. Treat it as something you should not open unexpected images from untrusted sources in Paint.
Why the fix isn’t obvious
The report flags that the fix for CVE-2026-83844 “is not obvious.” What that usually means is that there’s no quick toggle, registry change, or Group Policy setting you can flip to neutralize the bug. Instead, the real remedy is a software patch from Microsoft that corrects the underlying code in Paint.
That has a couple of implications. First, if you’re waiting for a workaround to keep using Paint safely until a patch arrives, you may be out of luck — the safest option is to avoid opening untrusted image files until you’ve updated. Second, it underscores that this is a code-level defect that only a proper update can resolve.
What this means for you
If you use Paint on Windows 11 — and a lot of people do, for quick screenshots, crop jobs, or simple edits — you’re running the affected software. The good news is that this isn’t a doomsday scenario: Microsoft has acknowledged the flaw, which is the first step toward a fix.
The realistic risk for most users comes from opening files from sources you don’t trust. Everyday users who only ever open images they’ve downloaded from sites they trust, or files sent by people they know, face a lower exposure. But because the reported vector involves remote exploitation, it’s worth treating unexpected image attachments with fresh suspicion.
How to protect yourself
The single most important thing you can do is keep Windows up to date. When Microsoft releases the update that patches this flaw, install it promptly through Windows Update.
In the meantime, a few sensible habits reduce your risk:
- Don’t open image files you weren’t expecting, especially attachments from unknown senders.
- Be cautious opening images sent via email, messaging apps, or downloads from untrusted websites.
- Keep your antivirus or Microsoft Defender active and scanning.
If you rely on Paint for work, consider holding off on opening untrusted images until the patch is available, then update as soon as it lands.
Source: Neowin
Over to you: Have you opened an unexpected image in Paint recently, and would you switch to another image viewer until Microsoft ships the patch?
