⚡A remote code execution vulnerability was discovered in Microsoft Paint.

"Microsoft Paint found vulnerable to remote code execution" — Hacker News (best) · AI & Technology

6 Nov 2026

What it means

Microsoft Paint (the classic Windows image editor) has a high-severity remote code execution vulnerability, tracked as -2026-83844. The flaw is an that can be exploited without authentication, allowing an attacker to execute arbitrary code on a target Windows 11 PC. Microsoft has released a fix through the Microsoft Store, but notably it is not being delivered via Windows Update, which has raised concerns about patch distribution.

Accuracy & sourcesSourced

The claim is well-supported. It originates from Microsoft's own security advisory and CVE assignment (CVE-2026-83844), making it a primary-source-level disclosure. Multiple independent security outlets (The Hacker News, Cybernews, Neowin) have confirmed the details, including the CVSS score of 8.1 and the out-of-bounds read vector.

How new

This is genuinely new: the vulnerability was disclosed and patched in November 2026, with articles appearing within the last two days.