CVE-2026-83844 is a high-severity out-of-bounds read vulnerability in Microsoft Paint that permits an unauthorized attacker to execute code over a network. Microsoft assigned a CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and rates the issue Important. The flaw affects Paint versions from 11.0.0.0 up to but not including 11.2605.91.0. Public records and subsequent reporting indicate the remediated build available through the Microsoft Store is 11.2609.401.0 (NVD).
Vulnerability Overview
Microsoft disclosed CVE-2026-83844 on 13 October 2026 as part of its monthly security updates. The root cause is CWE-125 (Out-of-bounds Read). An attacker who can induce Paint to process malicious content can cause the application to read memory outside its allocated bounds, which Microsoft states is sufficient to achieve code execution (CVE.org).
The CVSS vector indicates network reachability, high attack complexity, no required privileges, and no user interaction. Scope is unchanged, with high impact across confidentiality, integrity, and availability. Exploit maturity is unproven (E:U) and the official remediation level is official fix available (RL:O). No public proof-of-concept has been observed, the vulnerability is absent from the CISA Known Exploited Vulnerabilities catalog, and EPSS estimates remain low (OffSeq).
Technical Impact and Attack Considerations
Successful exploitation yields remote code execution in the context of the user running Paint. Because Paint is a Store-distributed application rather than a core OS component, the attack surface is limited to systems where the application is installed and can process attacker-controlled content. The network attack vector combined with the UI:N rating implies that an adversary can deliver a crafted image or related payload through any channel that causes Paint to parse it (network shares, email attachments, web downloads, or remote desktop sessions) without an explicit click beyond the initial delivery mechanism that opens the content in Paint.
Microsoft has not published the precise file format, parser path, or protocol involved. Defenders should treat any Paint image-processing workflow that accepts untrusted input as potentially relevant until further details emerge. High attack complexity reduces the likelihood of trivial exploitation, but the absence of required privileges or user interaction elevates residual risk once a workable trigger is identified.
Affected Versions and Patch Availability
Microsoft’s CVE record lists affected versions as 11.0.0.0 through builds prior to 11.2605.91.0. Subsequent updates to the Security Update Guide and administrator observations revised the fixed build to 11.2609.401.0. Early reporting indicated that the Microsoft Store continued to serve older builds (including 11.2605.81.0) even after the advisory was published, creating a gap between the CVE record and the actual Store catalog. As of early November 2026 the Store is distributing 11.2609.401.0 in multiple regions, and automatic Store updates have begun applying it to both user and provisioned copies (GetRFF).
Paint is updated independently of Windows cumulative updates. Applying the October 2026 OS patches does not remediate this vulnerability. Organizations must verify the installed package version through the Microsoft Store, Intune application inventory, or direct package inspection.
| Component | Affected Range | Fixed Build (Store) | Notes |
|---|---|---|---|
| Microsoft Paint | 11.0.0.0 – <11.2605.91.0 | 11.2609.401.0 | CVE record retains earlier fixed-build number; Store catalog updated later |
Mitigation and Detection Recommendations
Prioritize the following actions:
- Force a Microsoft Store update check and confirm every user profile and the provisioned package report version 11.2609.401.0 or later.
- In managed environments, deploy or refresh the Paint package via Intune or the organization’s approved Store application pipeline and retain evidence of the resulting version.
- Inventory systems that still have Paint installed. Where the application is not required, consider removal or disabling it through AppLocker, Windows Defender Application Control, or Store policy.
- Monitor for unusual process creation or image-related file activity originating from Paint (mspaint.exe or the Store package identity) on systems that process untrusted images.
- Because the vulnerability is not known to be exploited in the wild, standard patch prioritization applies; however, the network-accessible RCE primitive warrants accelerated validation in environments that routinely open external images.
No additional workarounds beyond version remediation are listed by Microsoft. Restricting network delivery of image files to Paint (for example via email gateway policies or web-content filtering) can reduce exposure while updates propagate.
Source
- Microsoft Security Update Guide: CVE-2026-83844 – Windows Paint Remote Code Execution Vulnerability
- NVD: CVE-2026-83844
- Microsoft CVE Record and subsequent Security Update Guide revisions (fixed build 11.2609.401.0): CVE.org