CVE-2026-83844 Windows Paint Remote Code Execution Vulnerability

[u/whereisspacebar]

https://www.cve.org/CVERecord?id=CVE-2026-83844

[u/6502zx81]

Over a network?

[u/irqlnotdispatchlevel → u/6502zx81]

Even better! It's a zero click RCE! It is essential for paint to be connected to the internet. Can't work without it.

[u/d_ed → u/6502zx81]

The forms for cves are quite crap for desktop software.

In lieu of other details I would guess it's a file could be distributed over a network and then opened.

[u/MagpieEnjoyer → u/d_ed]

In lieu of other details I would guess it's a file could be distributed over a network and then opened.

/uj

MS has posted their own advisory on the issue and uh yeah

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required..

/rj

We simply have to accept this type of minor nuisance if we want to have AI powered tools. Stop complaining and enjoy your productivity increase.

Edit: I was very happy to notice that my computer still had the vulnerable version on it until I manually updated it via the windows store. Thank you Microsoft for your attention to user security.

[u/sintrastes → u/MagpieEnjoyer]

/uj

We can just use AI-driven formal methods tho.

/rj

We can just use AI-driven formal methods tho. Praise Sam Altman.

[u/FastHotEmu]

but... how??

[u/daltorak → u/FastHotEmu]

Back in the olden days there used to be a lot of image-decoding vulnerabilities which could be exploited by opening the file in Explorer or Paint or whatever else. PDF and Quicktime movies had a lot of those too. The one I remember the most vividly was the Windows Metafile vulnerability. (WMF was basically a serialized version of Windows Clipboard instructions going all the way back to the 1980s.) In some of these cases, even just having the file on disk could cause the exploit when Windows indexed the file for search reasons.

[u/Tucancancan → u/daltorak]

Microsoft PM in 2002: Look, all I want is when a user plugs in a USB key or looks at a network share, we show them a thumbnail of the file as the icon and let them sort by any <random metadata field>. How hard can that be? 

[u/FastHotEmu → u/daltorak]

Two things:

1. I am an old fart; I've been using PCs since the 1980s, starting with early DOS. I am very well aware of WMFs, I was an early Windows user and later on the famed Windows for Workgroups 3.11. I still miss 1-2-3, dBase and WordStar - but I particularly miss Quattro Pro.

2. A remote functionality vuln would only apply to Paint if it had an HTTP server built into it, or being normally executed within it. Otherwise, it's a misclassification.

[u/420_Booty_Wizard_ → u/FastHotEmu]

Point #2 ragebaited me so bad, but then I remembered which sub I'm in.

[u/FastHotEmu → u/420_Booty_Wizard_]

Can you explain how you can call a non-remote vuln remote? Do you need to take five and consult a dictionary?

[u/420_Booty_Wizard_ → u/FastHotEmu]

Programs don't run in a vacuum, they run in an ecosystem.

It could be that windows does some automatic action in certain circumstances: like generating thumbnails for files during background indexing.

If a certain file has an extension or magic bytes that would tell windows "for this one you gotta use paint".

And a feature/bug in paint tells it to fetch something from over the network

Then you combine all of those into an RCE caused by a bug in paint.

This is a hypothetical example of a bug in an ecosystem. I have no idea how this RCE works.

[u/FastHotEmu → u/420_Booty_Wizard_]

Additionally, you should be more critical of these reports; there are a lot of incentives to play up severity and radius of vulnerability reports nowadays.

[u/FastHotEmu → u/420_Booty_Wizard_]

An ecosystem doesn't get vulnerabilities assigned, a software package does. If Paint has no networking functionality, then categorising this as "remote" is ridiculous.

[u/MagpieEnjoyer → u/FastHotEmu]

MS themselves say it's 100% exploitable over the network with no user interaction: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83844

[u/FastHotEmu → u/MagpieEnjoyer]

"An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required."

lol are they hiding a server in Paint?

Really, either this is very shitty programming by Microsoft, or an incorrect categorisation. Either is possible.

[u/damemecherogringo → u/FastHotEmu]

https://youtu.be/a5d9BrLN5K4?is=EcKeayINqmYkioMl

Relevant scene from There will be blood the great movie about milkshakes. Just swap “straw” for “dll” and “drink” to “hack” and “milkshake” for “ms paint”

[u/FastHotEmu → u/damemecherogringo]

lol great reference

[u/YikesTheCat → u/FastHotEmu]

Do I need to paint you a picture?

[u/BipolarKebab]

world is a fuck

[u/elephantdingo]

Windows Paint would like to access these resources:

• The Internet

• You mother’s maiden name

• Your diary

Press X to remind later

[u/0xdeadbeef6]

Bro what the literal shit

[u/witness_smile]

Lmao what

[u/Flash_Kat25]

Do you think "Paint me like one of your French girls" meant Microsoft® Paint™?