Microsoft Paint Vulnerability Allows Remote Code Execution via Crafted Network Packet
A critical vulnerability in Microsoft Paint (CVE-2026-3824) allows for remote code execution through an out-of-bounds read, with exploitation complexity noted as 'Less Likely'.
Microsoft has released security updates to address a critical remote code execution (RCE) vulnerability, tracked as CVE-2026-3824, affecting its ubiquitous Paint application. The flaw, stemming from an out-of-bounds read (CWE-125), could allow an unauthenticated attacker to execute arbitrary code over a network without requiring user interaction. While Microsoft has assigned a CVSS score of 8.1, placing it in the 'High' severity category, the complexity of exploitation is noted as 'Less Likely,' suggesting that successful attacks would require specific conditions to be met.
The vulnerability was disclosed as part of Microsoft's October 2026 security update cycle. The attack vector is described as network-based, requiring no privileges on the target system. However, details regarding the specific network service or the complete attack path remain somewhat ambiguous, with some speculation pointing towards potential interactions with components like Copilot, though this has not been officially confirmed. The initial advisory mentioned a crafted network packet as the means of exploitation, rather than a crafted image file.
A significant point of confusion for administrators has been the correct version of Microsoft Paint that contains the fix. Microsoft initially indicated that version 11.2605.91.0 was patched. However, reports from administrators suggested that the Microsoft Store continued to offer an older build, 11.2605.81.0, even after update checks and cache resets. Microsoft's subsequent advisory clarified that version 11.2609.401.0 is the corrected release, implying a potential discrepancy or error in the earlier communication.
This versioning confusion has complicated patch management efforts, as administrators need to verify the exact build installed on their systems rather than relying solely on the "up to date" status reported by the Microsoft Store. The availability of the corrected update also appears to have been inconsistent, with some users reporting difficulties in obtaining the patched version, while others found it readily available. There are unverified claims that update availability might vary by region.
Given the potential for RCE, even with a 'Less Likely' exploitation assessment, security professionals are advised to ensure their Windows systems have the latest Microsoft Paint build installed. For organizations where Paint is not a critical application, a temporary mitigation could involve uninstalling the application until a confirmed patched version is universally available and deployed. Restricting the handling of untrusted images can also be a general security practice, though it may not directly address the specific network-based attack vector described for this vulnerability.
Users and administrators are urged to consult the latest Microsoft security advisories for CVE-2026-3824 and verify their Microsoft Paint installation. The ongoing inconsistencies in update availability and version reporting highlight the importance of diligent patch verification and proactive system management in maintaining a secure computing environment. This incident also underscores the need for clear and accurate communication from vendors regarding vulnerability fixes and patch deployment status.