Red Hot Cyber
Cybersecurity, Cybercrime News and Vulnerability Analysis
In the drawing tool integrated in Microsoft Windows 11 (Microsoft Paint) a serious security vulnerability was recently discovered. Under specific conditions, attackers can send specially crafted network data packets to affected devices and potentially execute malicious code remotely without the user noticing, even without having to click on any file or link.
Even more concerning, Microsoft has already released a corrective patch, but some users, even with automatic Microsoft Store updates enabled, still cannot obtain the corresponding update. The vulnerability is identified as CVE‑2026‑83844, disclosed by Microsoft on October 13 2026, with a severity score of 8.1 out of 10, classified as “important”.
Although it did not reach Microsoft’s highest “critical” level, its potential impact cannot be ignored. According to Microsoft’s security bulletin, the vulnerability is an out‑of‑bounds read issue, where the program attempts to read data beyond the intended memory area. In certain circumstances, attackers can exploit this flaw to execute remote code, allowing them to run self‑written code on the affected computers.
Microsoft describes the attack method as follows: an unauthenticated attacker can send specially crafted data packets to the targeted service over the network, triggering the vulnerability. This means the attacker does not need to persuade the user to open malicious files or wait for the user to perform a specific action, which is why the media have labeled it a “zero‑click” vulnerability.
However, Microsoft also emphasized that actually exploiting this vulnerability presents a certain difficulty. At the time of the Windows Latest report’s publication, no real‑world exploitation cases had been reported. Therefore, while users should promptly verify their patch status, there is no need to panic excessively.
What is truly concerning is that a problem has emerged in the patch distribution. On October 13, alongside the vulnerability disclosure, Microsoft released a corrected version via the Microsoft Store. According to Microsoft’s support documentation, the tool must be updated to version 11.2609.401.0 or later to be considered protected against the vulnerability.
For users who wish to verify whether they are affected, they can check the tool’s actual version via Windows PowerShell.
The drawing tool, although merely a basic Windows application, can still become an entry point for attackers. What makes this vulnerability especially noteworthy is not only its ability to execute remote code, but also the fact that Microsoft announced a corrective solution, yet some users are unable to obtain the patch through normal update channels.
