Paint and RCE: how an image reader becomes an attack surface

Microsoft advisory: 13 October 2026. Analysis written on 4 November 2026. A drawing application can be a code-execution target because it parses untrusted files with native code. Image dimensions, compressed blocks, color profiles and metadata all become lengths and offsets used for memory access. For CVE-2026-83844, Microsoft explicitly classifies Windows Paint as remotely code-executable while describing the weakness as an out-of-bounds read.

That public description has a missing step. The CVE record published by Microsoft names no image format, parser, trigger file, second primitive or exploit chain. It lists affected Paint versions from 11.0.0.0 up to but excluding 11.2605.91.0 and a CVSS 3.1 score of 8.1. A claim that opening any PNG yields code execution would go beyond this evidence.

What an out-of-bounds read means

A parser intending to read n bytes at offset i in a buffer of length len must ensure i <= len and n <= len - i. A naïve i + n <= len check may fail if addition wraps in the chosen integer type. A resulting out-of-bounds read may crash the process or disclose adjacent bytes. It does not, by itself, show that an attacker can overwrite a return address or execute instructions. Some exploit chains use a memory disclosure to defeat address randomization and pair it with another bug; Microsoft has not published such a chain for this Paint CVE. Its RCE impact statement is authoritative, while the path from the documented read to code execution remains undisclosed.

Microsoft’s vector is AV:N/AC:H/PR:N/UI:N: network attack vector, high attack complexity, no prior privilege and no user interaction in its rated scenario. This does not demonstrate that Paint listens on a network port or that an emailed image runs automatically. CVSS does not identify the application entry path. The high complexity signals additional conditions whose nature the public record does not explain.

How to investigate the flaw responsibly

An authorized researcher would inventory the formats Paint really accepts, mutate lengths, counts and truncation points, and compare old and patched builds under memory instrumentation. A minimized crashing file plus a trace can identify the read, its source value and the failed bounds check. Only an additional control-flow demonstration would establish the RCE mechanics. This is a discovery method, not a claim about how the original reporter found CVE-2026-83844; the public record does not say.

For remediation, inventory the Paint application version and update it to at least 11.2605.91.0 using the organization’s Microsoft Store or application-management channel. A recent Windows operating-system patch date alone does not establish that the Store app has updated. Continue treating images from outside the organization as untrusted data while patching.

The technically honest answer to “how can Paint provide RCE?” has two levels: native decoding can turn malformed data into memory corruption in general; for this specific CVE, Microsoft claims RCE but has not disclosed the complete path from out-of-bounds read to execution.

The CVSS calculator breaks down the published vector without reconstructing an undisclosed exploit chain. Our “CVSS is not risk” note explains why endpoint exposure, actual usage and patch deployment still matter when setting priorities.

Primary sources: Microsoft advisory, Microsoft-assigned CVE JSON.