Microsoft Paint vulnerability enables remote code execution (CVE-2026-83844)
An out-of-bounds read in Windows Paint build 11.2609.401.0 lets unauthenticated attackers execute code remotely without interaction.
70
CVE-2026-83844
Network RCE via out-of-bounds read in Windows Paint
- CVSS 3.1
- 7.0 high
- EPSS
- <1%p33
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-83844 is an out-of-bounds read (CWE-125) in Microsoft Windows Paint that Microsoft rates as high severity (CVSS 3.1 base score 8.1). An unauthorized attacker can trigger the flaw over a network without credentials or user interaction, though attack complexity is high, and successful exploitation can lead to remote code execution with high impact on confidentiality, integrity, and availability. Scope is unchanged, so the attacker’s access stays within the affected component. Anyone running a Windows installation that includes the vulnerable Paint component is potentially affected; specific version ranges were not published in the source data. It is not listed in CISA’s Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known.
What to do: Install the Microsoft security update that addresses CVE-2026-83844 as soon as it is offered through Windows Update or your enterprise patch channel, and confirm the fix is present on systems that include Windows Paint. Until patched, restrict unnecessary network exposure of hosts and prioritize internet-facing or high-value Windows systems. No public workaround is described in the available data.
| Product | Affected |
|---|---|
| Microsoft Windows Paint | — |
Estimated exposure
mass≈1 billion+ Windows installations (Paint is a default Windows component; vulnerable subset unknown) — Windows Paint ships as a built-in component of Windows, which is deployed on well over a billion consumer and enterprise PCs worldwide; no public scan count of vulnerable builds is available.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Out-of-bounds read in Windows Paint allows an unauthorized attacker to execute code locally.
- Weakness
- CWE-125
- Vector
- CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
In the news
5 storiesMicrosoft Paint remote code execution vulnerability (CVE-2026-83844)
Out-of-bounds read in Windows Paint allows remote code execution; Microsoft Paint versions 11.0.0.0 through 11.2605.91.0 affected.
60
Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It
Fixed build 11.2609.401.0 is now in the Microsoft Store but Windows Update does not deliver it.
55
Microsoft patches Windows Paint local RCE flaw CVE-2026-83844
The out-of-bounds read needs local access and user interaction; Microsoft rates exploitation less likely.
48
Microsoft Paint RCE CVE-2026-83844 raises store update questions
A new CVE in Microsoft Paint has been disclosed, raising questions about store update processes.
30