CVE-2026-83844 Windows Paint Remote Code Execution Vulnerability
Out-of-bounds read in Windows Paint allows an unauthorized attacker to execute code over a network.
Why am I seeing this Ranked on source trust — Microsoft
It ranks mainly on source trust: Microsoft is the most reliable outlet we track on this subject, and is the only one on the story so far.
Hacker News also has it, but as a tier-3 aggregator it is shown for context and counts for nothing in the score.
StandardStandard, because a first-party source is on it, the subject was identified from the text, and it scores 0.58 against a bar of 0.50.
| Factor | Weight | Score | Contribution | Where it came from |
|---|---|---|---|---|
| Corroboration | 0.35 | 0.39 | +0.135 23% | 1 independent org on the story. Tier-3 aggregators never corroborate — they can show something is circulating, never that it is true. |
| Source trustleads | 0.25 | 1.00 | +0.250 43% | Microsoft is the highest-trust source on this story and is first-party — the organisation announcing its own news. Trust is taken from the best source, not averaged. |
| Pickup rate | 0.20 | 0.00 | +0.000 0% | One counted organisation, so there is no spread to measure — nothing has picked this up to set a rate. |
| Freshness | 0.20 | 0.97 | +0.193 33% | Halves every 10 hours from the newest item on the story. This is the only factor that rewards a story for nothing more than being recent. |
Corroboration counts distinct organisations, once each, and only from tiers 1 and 2 — Hacker News appears on this story and counts for nothing. Freshness halves every 10 hours, so this ranking is a snapshot and will differ at the next build.
What happened
Out-of-bounds read in Windows Paint allows an unauthorized attacker to execute code over a network. Article URL: https://www.cve.org/CVERecord?id=CVE-2026-83844 Comments URL: https://news.ycombinator.com/item?id=50384233 Points: 247 # Comments: 68
Reachable over the network with no credentials, and leads to code execution.
- Impact
- Remote Code Execution
- Vector
- Network
- Auth
- None required
- Product
- Windows Paint
How this story arrived
Ordered by when each source was first observed, which is what the velocity figure is computed from. Publishers backdate; observed order does not.
- 01 Microsoftfirst-party first seen CVE-2026-83844 Windows Paint Remote Code Execution Vulnerability
- 02 Hnrss +555.1h MS Paint Remote Code Execution Vulnerability
Overclock clusters coverage from independent sources and grades it automatically. The figures above are computed, not editorial. This page summarises and links to reporting by the outlets named — follow the links for the original work.