LIVE FEED

Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiperHardening a Personal Linux Server in an AfternoonMicrosoft 365 outage disrupts Outlook, Teams, and Copilot worldwideCheck Point patches zero-day root escalation flaw exploited against customersHackers Compromise 4,800 GitHub Accounts to Steal Cloud CredentialsHow to Put a Self-Hosted Service Behind SSO and Intrusion Blocking in an AfternoonBaker Tilly notifies clients of data breach at third-party provider

HIGH CWE-125

CVE-2026-83844

Windows Paint Remote Code Execution Vulnerability

Microsoft·Paint

7.0/ 10

CVSS 3.1

High severity

0.38%

EPSS exploit odds

Chance of exploitation in the next 30 days

Higher than 33% of all CVEs

Not listed

CISA KEV catalog

No confirmed in-the-wild exploitation on CISA's list.

Timeline

Published: Oct 13, 2026
Updated: Nov 10, 2026
First covered: Nov 9, 2026
Latest story: 5 days ago

Summary

Out-of-bounds read in Windows Paint allows an unauthorized attacker to execute code locally.

CWE-125Out-of-bounds Read

Attack profile

Attack vectorLocal

ComplexityHigh

PrivilegesNone

User interactionRequired

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Affected products

Microsoft Paint11.0.0.0 to before 11.2609.401.0

References

CVE.org recordcve.org NVD entrynvd.nist.gov Windows Paint Remote Code Execution Vulnerabilitymsrc.microsoft.com