Critical Security Flaw Found in Microsoft Paint, Prompting High-Profile Warning

A serious security vulnerability has been discovered in a ubiquitous Windows application—Microsoft Paint. The issue garnered widespread attention after Binance founder Changpeng Zhao shared an urgent warning on social media, urging users to take immediate action to secure their systems.

Understanding the Threat: Remote Code Execution via Images

Microsoft has officially disclosed the vulnerability, assigned CVE-2026-83844 with a high CVSS score of 8.1. The flaw affects Microsoft Paint versions earlier than 11.2605.91.0.

Technically classified as an "out-of-bounds read" issue, this vulnerability could allow an unauthenticated attacker to craft a malicious image file. If opened in a vulnerable version of Paint, the application could be tricked into reading memory beyond its intended limits. Successful exploitation might lead to remote code execution, effectively granting an attacker control over the compromised computer.

The Imperative Next Step: Update Your System Now

In his warning, Zhao highlighted a crucial principle: "Applications cannot protect you from operating system vulnerabilities." This underscores that while the flaw exists in a specific app, the solution resides in a comprehensive system update.

Security professionals recommend the following actions immediately:

  • Primary Action: Run Windows Update and install all available patches. This is the most direct way to apply the fix Microsoft has released.
  • Risk Mitigation: Exercise caution with image files from untrusted sources until your system is fully updated. Avoid opening them with Paint if possible.
  • Ongoing Vigilance: While there are no confirmed reports of active attacks exploiting this flaw, complacency is risky. Proactive protection is key.

Microsoft's patch is now available. For end-users, maintaining an updated operating system remains the simplest and most effective defense against evolving cyber threats. In today's digital landscape, timely updates are not just a recommendation—they are a necessity for basic security.