Microsoft patches Windows Paint local RCE flaw CVE-2026-83844
Original title: Microsoft Fixes RCE Bug in Windows Paint After Weeks of Confusion
The out-of-bounds read needs local access and user interaction; Microsoft rates exploitation less likely.
Microsoft patched an out-of-bounds read in Windows Paint, CVE-2026-83844, that can let an unauthorized attacker execute code locally. The flaw has a CVSS 3.1 score of 7.0 and requires local access plus some user interaction. Microsoft says it has seen no exploitation reports and marks exploitation as less likely. The fixed Paint version is 11.2609.401.0, available through the Microsoft Store.
Unconfirmed: Affected version ranges are not stated, and the article's timeline details are cut off.
- Customers can check the version under Paint, Settings, About.
- Automatic Microsoft Store updates already protect some customers.
- Manual installs are available under Microsoft Store App, Downloads, Check for updates.
- Patch messaging had been unclear for nearly a month after disclosure.
Impact: local code execution after user interaction
| Product | Affected | Fixed in |
|---|---|---|
| Microsoft Windows Paint | — | 11.2609.401.0 |
- 1.Install Windows Paint 11.2609.401.0 from the Microsoft Store.
- CVEs
- CVE-2026-83844
- Vendors
- Microsoft
- Products
- Windows Paint
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-83844 | Network RCE via out-of-bounds read in Windows Paint | 7.0 | <1% | PoC ×7 |
From the original article
6 min read at darkreading.com
Last month, Microsoft disclosed a vulnerability in Microsoft Paint, but messaging regarding a patch was unclear.
By Alexander Culafi · darkreading.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.