MS Paint remote code execution vulnerability
Archived — this story has rotated out of today’s deck. It is kept here in full.
The gist
Microsoft disclosed a Windows Paint remote code execution flaw rated 8.1 and classed Important.
The fix ships via the Microsoft Store, so Windows Update may not patch it.
Background
Microsoft is the vendor behind Windows and its built-in Paint app, and it disclosed CVE-2026-83844, a remote code execution vulnerability in Windows Paint, in its October 2026 Patch Tuesday round. The flaw is rated 8.1 under CVSS 3.1 (a standard severity scoring system) and classed "Important." It drew attention because Paint is maintained through the Microsoft Store, so an up-to-date Windows installation is not enough if the app itself has not been patched — and users reported trouble finding the fixed version.
How it unfolded
- Sep 8, 2026September 2026 Patch Tuesday included CVE-2026-70586, an earlier Windows Paint remote code execution vulnerability (heap-based buffer overflow, CVSS 8.8).
- Oct 13, 2026Microsoft publicly disclosed CVE-2026-83844, a Windows Paint remote code execution vulnerability rated 8.1 and classed "Important"; Rapid7 lists exploitation as "Less Likely."
- Nov 5, 2026Reports said administrators could not obtain the patched Paint version, with confusion over the correct version number.
- Nov 6, 2026Microsoft identified Paint build 11.2609.401.0 as the security update, telling users to verify the build rather than assume Windows Update fixed it.
Key terms
- CVE-2026-83844
- A unique identifier in the CVE system for a publicly known information-security vulnerability.
- CVSS
- A framework for rating the severity of computer system vulnerabilities on a scale from 0 to 10.
- out-of-bounds read
- A software flaw where a program reads data outside a buffer's boundary from adjacent memory.
Source: Wikipedia
Who’s saying what
- Official
- Microsoft describes the bug as an out-of-bounds read, rates attack complexity as "High," and says exploitation is less likely because it requires detailed system knowledge.
- Caution
- Windows Latest describes it as a no-click bug that can remain unpatched even with automatic updates enabled.
Still unverified
No reports of the vulnerability being exploited in the wild. One user claimed the patch is only available in South Asian regions. The earlier listed version appears to have contained a typo, though Microsoft has not confirmed this.