VULNpocalypse
HighVulnerabilityMonitoring

Windows Paint out-of-bounds read (CVE-2026-83844) allows zero-click remote code execution

Windows Paint out-of-bounds read (CVE-2026-83844, CVSS 8.1) enables zero-click RCE over a network. A fix shipped, but its availability is disputed.

Published
Updated
Fixed in
A fix shipped, but the correct build is disputed, the CVE record implies 11.2605.91.0, while the advisory and reporting cite 11.2609.401.0, and some administrators report they could not obtain a corrected build.
Exploitation
No confirmed evidence of exploitation. The CVE record’s CISA SSVC assessment lists Exploitation “none” and the CVSS vector is E:U (Unproven); Microsoft considers exploitation “less likely.”

What happened

  • CVE-2026-83844 is a “Windows Paint Remote Code Execution Vulnerability”, described in the CVE record as an “out-of-bounds read in Windows Paint” that “allows an unauthorized attacker to execute code over a network.” It is assigned by Microsoft and was published on 13 October 2026 (last updated 31 October 2026) (CVE record).
  • The weakness is CWE-125 (Out-of-bounds Read), a memory-handling error where software reads beyond a buffer’s intended boundary (CVE record; The420.in).
  • Severity: CVSS v3.1 8.1 (High), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C (CVE record). Both outlets report 8.1 and characterise it as high-severity, though they note Microsoft itself rated the flaw “important” rather than critical (Cyber Security News; The420.in).
  • Zero-click, network, unauthenticated. Reporting says the flaw could let “an unauthenticated attacker to execute code over a network without user interaction,” with no click, file open, or login required; the attack vector is network, privileges required none, and attack complexity is high (Cyber Security News; The420.in).
  • Microsoft’s quoted guidance describes a specially crafted network packet sent to an affected service; the exposed service and full attack path are not identified in the reporting (Cyber Security News).
  • No confirmed exploitation. There is “no confirmed evidence” that attackers have exploited the flaw; Microsoft considers exploitation “less likely” because it requires detailed knowledge of the target environment (The420.in). The CVE record’s CISA SSVC data lists Exploitation “none” and the CVSS vector carries E:U (Unproven) (CVE record).
  • The flaw was reported by an anonymous researcher through Microsoft’s disclosure channel (The420.in).

Patch availability is disputed. The CVE record lists affected versions “from 11.0.0.0 up to but not including 11.2605.91.0,” implying 11.2605.91.0 is the first fixed build (CVE record). However, reporting says Microsoft first listed 11.2605.91.0 as the fix while the Microsoft Store kept offering 11.2605.81.0, and the advisory later listed 11.2609.401.0 as the fix, with Microsoft not confirming why the earlier reference was wrong; some administrators could not get a corrected build, though at least one user reported receiving an update via the Store (Cyber Security News). The420.in identifies the fixed build as 11.2609.401.0 and its headline flags patch availability as “questioned,” although its body states Microsoft “has patched” the flaw (The420.in).

What to do

  1. Check the installed Paint build directly rather than relying on a general “Windows is up to date” message, since a system update does not necessarily cover the Paint app (Cyber Security News; The420.in).
  2. Update Windows Paint via the Microsoft Store to a fixed build. Reporting points to 11.2609.401.0 as the fix; the CVE record implies 11.2605.91.0 is the first unaffected version, treat the higher build as the safer target given the disputed references (CVE record; Cyber Security News; The420.in).
  3. Where an updated build is unavailable, consider removing Paint on systems that do not need it, as suggested in reporting; note that restricting untrusted images is not confirmed to mitigate this network attack path (Cyber Security News).
  4. Follow Microsoft’s advisory (MSRC update guide entry for CVE-2026-83844) for the authoritative fixed-version guidance (CVE record).

Sources