Microsoft has disclosed CVE-2026-83844, an out-of-bounds read in the Microsoft Store version of Paint that could allow remote code execution. Microsoft rates the vulnerability Important, while its CVSS score of 8.1 places it in the high-severity range. Its assessment indicates a network-based attack requiring no privileges or user interaction, although successful exploitation has high complexity.
Microsoft Paint RCE CVE-2026-83844 Raises Store Update Questions
About this summary. This is a short excerpt from the description that SOCRadar published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://socradar.io/blog/microsoft-paint-cve-2026-83844-store-update/
Source attribution: headline and facts are from SOCRadar (socradar.io). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
What exploited vulnerabilities have in common: A data-driven analysis of real-world attacks
Classifying the vulnerability landscape Vulnerabilities exploited in the wild Where defenders should focusPatching is slow, while exploitation is fast Impact, exposure…
UEFI bootkit infected fully patched Windows machines. Is Microsoft to blame?
In 2023, malware tracked as BlackLotus became the first publicly documented in-the-wild UEFI bootkit capable of bypassing Secure Boot on fully updated Windows 11…
ZDI-26-868: Microsoft Windows Aero Theme Improper Handling Of Error Condition Denial-of-Service Vulnerability
This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Microsoft Windows. An attacker must first obtain the…
Pre-Auth RCE in Zyxel GS1900 Exploited in the Wild as a Zero-Day
GreyNoise and CISA KEV linked this Zyxel GS1900 exploit to CVE-2026-7273, but it hits a zero-day. We cover the actor, JITTERLY, SIXZUT, and the exploit.
ZDI-26-850: Microsoft Qlib MLflowRecorder Deserialization of Untrusted Data Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Qlib. User interaction is required to exploit this…
ZDI-26-849: Microsoft Qlib RestrictedUnpickler Deserialization of Untrusted Data Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Qlib. User interaction is required to exploit this…