A critical remote code execution vulnerability has been identified in Microsoft Paint, tracked as CVE-2026-83844. The flaw allows attackers to execute arbitrary code on a victim's machine simply by opening a specially crafted image file. Security researchers warn that this vulnerability could be exploited in the wild, posing a significant threat to users of the widely used drawing application.
Microsoft has confirmed the issue and is working on a patch to address the security hole. The vulnerability stems from improper handling of image metadata within the Paint application, enabling malicious code execution when a user opens a compromised file. Users are advised to exercise caution when opening images from untrusted sources until the fix is released.
The discovery has sparked discussions on legacy software security, with many questioning why such a basic application remains vulnerable after decades of updates.
Source: Hacker News · Summarized by HeadlinesBriefing