There was an RCE recently disclosed for ... paint.exe - CVE-2026-83844

https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...

So really anything is on the table at this point

Except, once again Microsoft crapped the bed... it's not an RCE in any capacity...

> Revision 2.1, Nov 7: “Added an FAQ and updated the CVSS score. This is an informational change only.” > Vector: now AV:L and UI:R (local attack vector, user interaction required), scoring 7.0.