Microsoft Paint EUVD-2026-99382

Exploitation requires a victim to open a maliciously crafted image file in Microsoft Paint on a vulnerable build (Paint 11.0.0.0 through versions earlier than 11.2605.91.0); this user-opens-a-file step is the primary limiting factor despite the supplied vector's UI:N rating, since Paint exposes no network service. The high attack complexity (CVSS AC:H) is a further limiter - converting an out-of-bounds read into code execution typically demands precise memory layout/heap grooming and may be build- or data-dependent. No authentication or special privileges are needed on the target (PR:N), and no non-default configuration is required beyond having a vulnerable Paint version installed.

This is a moderate-to-high severity client-side flaw (CVSS 8.1) rather than an urgent emergency, and the signals are notably mixed. The CVSS vector claims AV:N/PR:N/UI:N - remote, unauthenticated, no user interaction - but the affected product (Microsoft Paint) is a desktop image-editing application with no network-listening service, so realistic exploitation almost certainly requires a victim to open a crafted image file; the UI:N rating should be treated skeptically and verified against the Microsoft advisory. AC:H already signals that reliable exploitation is difficult. Exploitation-probability signals are reassuring: there is no CISA KEV listing and no public exploit identified, and CISA's SSVC framework rates Exploitation as 'none' and Automatable as 'no' (consistent with a flaw that needs user interaction and complex memory manipulation), while rating Technical Impact as 'total.' There is also an internal inconsistency worth flagging: CWE-125 (out-of-bounds read) and the 'Information Disclosure' tag point to a memory-disclosure primitive, yet the description and CVSS (C:H/I:H/A:H) assert full code execution - an OOB read alone rarely yields RCE, so this likely chains with other conditions or the description over-states impact. Net: patch on a normal cadence; this is not drop-everything, but the 'total' technical impact and ubiquitous product footprint justify not deferring it indefinitely.

An attacker crafts a malformed image file (e.g. a BMP/JPEG/PNG) that triggers an out-of-bounds read in Microsoft Paint's parsing logic and delivers it to a victim via email, a web download, or a shared drive. When the victim opens the file in a vulnerable Paint build (11.0.0.0 up to 11.2605.91.0), the memory-corruption condition is triggered, potentially leading to code execution in the user's context. No public proof-of-concept exploit has been identified, and the high attack complexity (AC:H) means weaponization is non-trivial.