CZ Warns of Windows System Vulnerability Risk: Apps Cannot Defend Against OS-Level Vulnerabilities—Urges Users to Update Immediately

On November 7, Binance founder CZ shared a security alert regarding a critical vulnerability in Microsoft Paint, emphasizing: “Operating system–level vulnerabilities are beyond the control of applications—update your OS immediately.” Officially designated CVE-2026-83844 by Microsoft, the flaw carries a CVSS score of 8.1 and affects all versions of Windows Paint prior to 11.2605.91.0. The root cause is an out-of-bounds read defect, enabling unauthenticated attackers to remotely execute arbitrary malicious code without any user interaction. Microsoft has issued an emergency official security patch; as of now, there is no confirmed evidence of active exploitation. CZ used the incident to underscore that application-layer protections cannot compensate for missing OS-level security updates—users must prioritize and promptly install patches for both their operating systems and applications.