{"rewrite":{"id":"r_fa68c5248d19f798be9492d1","clusterId":"c_8314386f8bdcfd462cf1acf3","slug":"windows-paint-carries-a-high-severity-remote-code-execution-flaw","model":"deepseek-v4-1-flash","headline":"Windows Paint Carries a High Severity Remote Code Execution Flaw","summary":"Microsoft's Paint app has a remote code execution vulnerability tracked as CVE-2026-83844, scored 8.1 and rated High. Affected versions run from 11.0.0.0 through 11.2605.91.0, the latter released on June 12, 2026. The flaw is an out-of-bounds read that lets Paint read past its intended memory range while processing images, and an unauthenticated attacker could exploit it by sending a crafted packet over the network.","whyItMatters":"A drawing app that most users treat as harmless now sits on the same patch cycle as the rest of Windows, and the fix arrived through the Microsoft Store rather than Windows Update for at least some users.","webCardHtml":"\u003cp\u003eThe vulnerability is an out-of-bounds read. Paint reads beyond its intended range in memory when it processes images, and the CVE entry puts the score at 8.1 with High severity. The affected range spans 11.0.0.0 to 11.2605.91.0, and that last build shipped on June 12, 2026.\u003c/p\u003e\u003cp\u003eUsers on Hacker News reported that the fixed build came through the Microsoft Store, with nothing appearing in Windows Update. Others questioned why a drawing program accepts network input at all, since the description describes an unauthenticated attacker sending a crafted packet to an affected service.\u003c/p\u003e","blueskyPost":"CVE-2026-83844 affects Windows Paint builds through 11.2605.91.0, released on June 12, 2026. The trigger is a crafted network packet, so the image editor's out-of-bounds read is an unauthenticated remote exposure.","twitterPost":"CVE-2026-83844 is remotely triggerable: an unauthenticated attacker sends a crafted packet and Windows Paint reads past its intended memory range.","threadsPost":"Windows Paint's affected range ends at 11.2605.91.0, a build released on June 12, 2026. CVE-2026-83844 reaches the image editor through a crafted network packet, so an unauthenticated attacker can trigger the out-of-bounds read remotely.","newsletterBlurb":"Microsoft's Paint app has a remote code execution vulnerability, CVE-2026-83844, scored 8.1 and rated High. Affected builds run from 11.0.0.0 to 11.2605.91.0, which shipped on June 12, 2026. The flaw is an out-of-bounds read that occurs while Paint processes images.","attributionJson":"[{\"source\":\"GIGAZINE\",\"url\":\"https://gigazine.net/news/20261106-ms-paint-remote-code-execution-vulnerability/\",\"title\":\"For Some Reason, Windows 'Paint' Has a Remote Code Execution Vulnerability\"}]","lintFlagsJson":null,"lintHits":0,"costUsd":0,"inputTokens":5547,"outputTokens":760,"status":"published","repairAttempts":0,"nextRepairAt":null,"factsAttemptedAt":1793962220,"createdAt":"2026-11-06T10:45:58.000Z","publishedAt":"2026-11-06T10:48:52.000Z","updatedAt":"2026-11-06T10:48:52.000Z"},"cluster":{"id":"c_8314386f8bdcfd462cf1acf3","canonicalTitle":"なぜかWindowsの「ペイント」にリモートコード実行の脆弱性","representativeArticleId":"a_ce896771c133c4d086b5764c","sourceCount":1,"writtenSourceCount":1,"writeAttempts":0,"isSolo":true,"entitiesJson":"{\"anime_titles\":[],\"manga_titles\":[],\"work_titles\":[\"Microsoft Paint\"],\"studios\":[],\"people\":[],\"type\":\"news\",\"domain\":\"other\",\"is_roundup\":false}","contentType":"news","status":"published","firstSeenAt":"2026-11-06T10:00:00.000Z","lastSeenAt":"2026-11-06T10:00:00.000Z","updatedAt":"2026-11-06T10:48:52.000Z"},"attribution":[{"source":"GIGAZINE","url":"https://gigazine.net/news/20261106-ms-paint-remote-code-execution-vulnerability/","title":"なぜかWindowsの「ペイント」にリモートコード実行の脆弱性"}],"entities":{"anime_titles":[],"manga_titles":[],"work_titles":["Microsoft Paint"],"studios":[],"people":[],"type":"news","domain":"other","is_roundup":false},"keyFacts":["CVE-2026-83844 is a remote code execution vulnerability in Microsoft's Paint app, scored 8.1 and rated High.","Affected Paint versions run from 11.0.0.0 to 11.2605.91.0.","Version 11.2605.91.0 was released on June 12, 2026.","The flaw is an out-of-bounds read that occurs when Paint processes images.","An unauthenticated attacker could exploit the vulnerability by sending a crafted packet over the network."],"pageLinks":{"healthSlugs":["microsoft-paint"],"storySlugs":[],"entities":[{"slug":"microsoft-paint","supported":0,"disputed":0,"contradicted":0,"unverified":10,"overall":"unverified","story_count":1,"has_dossier":false}],"stories":[],"entitiesOk":true,"storiesOk":true}}