Microsoft patched a remote code execution vulnerability (CVE-2026-83844) in Windows Paint that allowed local attackers to execute code with user interaction. Despite Microsoft disclosing the flaw in mid-October, confusion arose over the availability and details of the fix, which was ultimately deployed via the Microsoft Store in early November. The vulnerability carries a high severity score but requires local access and user action, with no known exploitation reports to date.
https://www.darkreading.com/application-security/microsoft-rce-bug-windows-paint-confusion