This vulnerability is an out-of-bounds read in Microsoft Paint that can be leveraged to execute arbitrary code. By sending or opening a specially crafted file, an attacker can trigger the memory read beyond its bounds, forcing the application to execute injected code. The weakness is categorized as CWE‑125.

The flaw affects Microsoft Paint on Windows systems. No specific product versions are listed in the advisory, so all current deployments of Paint that have not yet applied the Microsoft security update are considered susceptible.

The CVSS score of 8.1 marks this as a high‑severity RCE. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is remote: an attacker can deliver the malicious file over a network connection, for example via Remote Desktop, file shares, or other network‑exposed services that allow users to open images. The lack of EPSS data does not diminish the threat posed by a known RCE, but it does make precise likelihood estimation difficult.