Microsoft discloses Paint RCE vulnerability
Original title: Microsoft Paint 0-Click Vulnerability Could Allow Hackers to Take Control of Windows PCs
Microsoft warns of out-of-bounds read in Paint (CWE-125) enabling unauthenticated remote code execution; users must update to build 11.2609.401.0 or later.
Microsoft disclosed a flaw in Windows Paint allowing remote code execution via crafted network packets with no user interaction or sign-in required. The out-of-bounds read could affect data privacy, integrity, and availability. The advisory was released during the October 2026 Patch Tuesday and notes complex exploitation needing detailed system knowledge. Affected Paint builds include 11.2609.401.0 and earlier; NIST lists versions below 11.2605.91.0. No known exploitation or prior disclosure.
Unconfirmed: Microsoft originally assessed exploitation as less likely; actual success depends on environment and controls.
- Out-of-bounds read tracked as CWE-125
- Remote code execution possible without authentication
- Complex exploitation requires system knowledge
- Paint build 11.2609.401.0 listed as affected
- Check version with Get-AppxPackage PowerShell command
Impact: remote code execution
- 1.update Paint via Microsoft Store
- 2.verify installed version with Get-AppxPackage
From the original article
2 min read at cybersecuritynews.com
Microsoft has disclosed a Windows Paint vulnerability that could let an attacker run code remotely without signing in or requiring a user to click anything. Published on October 13, 2026, the advisory describes an out-of-bounds read, tracked under CWE-125. This means the program reads memory outside its intended limits.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.