> ## Content Index
> Fetch the complete content index at: https://www.privacyguides.org/llms.txt
> Use this file to discover other available public pages before exploring further.

# Microsoft Paint Vulnerability Could Allow Attackers to Take Over Your Computer
- URL: https://www.privacyguides.org/news/2026/11/07/microsoft-paint-vulnerability-could-allow-attackers-to-take-over-your-computer/
- Published: 2026-11-07T19:49:56.000Z
- Updated: 2026-11-07T19:49:56.000Z
- Description: A high-severity vulnerability in Microsoft Paint could allow an attacker to run malicious code on your machine over a network.
- Author: Fria Reyes
- Tags: News Briefs

A high-severity [vulnerability](https://windowsreport.com/microsoft-paint-security-flaw-could-let-hackers-execute-malicious-code-but-the-fix-is-hard-to-find/) in Microsoft Paint could allow an attacker to run malicious code on your machine over a network.

Microsoft's [official](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83844) description of the issue at a CVSS rating of 8.1, making it a high-severity bug.

The main attack vector is over the network, which is alarming for an art program that shouldn't even need network connectivity in the first place.

Microsoft added Copilot AI functionality to many of its apps at one point including [Paint](https://support.microsoft.com/en-us/windows/ai/ai-apps/use-copilot-pc-features-in-paint), requiring network functionality in order to work and even forcing you to sign in to your Microsoft account to use the AI features:

> These features make use of the [Neural Processing Unit (NPU)](https://support.microsoft.com/en-us/topic/e77a5637-7705-4915-96c8-0c6a975f9db4) to generate images locally on your computer. There are no restrictions on how many images you can generate. However, to use these features, you need to sign in with your [Microsoft account](https://support.microsoft.com/en-us/topic/72f10e1e-cab8-4950-a8da-7c45339575b0) and be connected to the internet to access cloud services that ensure safe use of AI.

Microsoft says the actual image generation happens on-device, but "content filtering" happens in the cloud, with them collecting device and user identifiers in the process:

> Microsoft values your privacy and data security. We acknowledge the safety risks of AI generated images and hence follow the unique hybrid approach of running the necessary safety systems on cloud using Azure online services to help ensure the safe and ethical use of AI, while the image generation happens on the device.

> The Azure online services perform content filtering to prevent the generation of harmful, offensive, or inappropriate content. Microsoft collects attributes such as device and user identifiers, along with the user prompts, to facilitate abuse prevention and monitoring. 

> Microsoft does not store your input images or generated images.

On top of being a privacy issue, all this network and AI functionality in what should be an offline art program adds unnecessary attack surface, and leaves users more vulnerable to potential exploits like this one.

Microsoft says it's not aware of the exploit being used in the wild, but you should still check for updates in the Microsoft Store by clicking on "Downloads."

The issue is an out-of-bounds read, a memory safety issue that could be mitigated if they used a memory-safe language for their apps.

Unfortunately, it seems like they haven't made enough progress in that area even though they have their own memory-safe [language](https://devblogs.microsoft.com/dotnet/improving-csharp-memory-safety/) that they want other developers to use for their apps.