Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

Microsoft patches Paint CVE-2026-83844 after conflicting advisories

6 sources · 6 articlesFirst reported Updated ()2 · 1 read
What's new

November 9: Dark Reading says the bug needs local access and user interaction, scores it CVSS 7.0, and says patch messaging was unclear for nearly a month.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

A Store fix for Paint CVE-2026-83844 is available, while reports disagree on whether the bug is remote or local.

Microsoft disclosed CVE-2026-83844, an out-of-bounds read (CWE-125) in Windows Paint, and a fixed build, 11.2609.401.0, is available in the Microsoft Store rather than through Windows Update. Earlier reports said an unauthenticated attacker could execute code over the network with no user interaction, rating the issue Important at CVSS 8.1. Dark Reading now reports the flaw needs local access and some user interaction, with a CVSS 3.1 score of 7.0. Microsoft says it has seen no exploitation and rates it less likely. Version ranges also conflict: Hacker News cites builds from 11.0.0.0 before 11.2605.91.0, while other outlets treat 11.2609.401.0 as the affected or fixed build.

Key facts
  • CVE-2026-83844 is a CWE-125 out-of-bounds read in Windows Paint.
  • Dark Reading: CVSS 7.0, local access and user interaction required.
  • Earlier outlets: CVSS 8.1, unauthenticated network RCE, no interaction.
  • Fixed build 11.2609.401.0 is delivered via the Microsoft Store, not Windows Update.
  • Microsoft reports no known exploitation; not listed in CISA KEV.
  • Advisory was released during the October 2026 Patch Tuesday, according to Cyber Security News.
Analyze CVE-2026-83844 with Vani AIImpact, affected versions, exploitation, mitigations and detection

What each outlet adds

beyond the shared facts
  • Dark ReadingRevises impact to local access, user interaction, and CVSS 7.0.
  • The Hacker NewsStore-only fix, PowerShell checks, and absence from CISA KEV.
  • Cyber Security NewsOctober 2026 Patch Tuesday timing and NIST version listing.
  • Hacker NewsAffected range 11.0.0.0 before 11.2605.91.0.
  • GBHackersTemporal score 7.1 and unproven exploitation maturity.
CVEs
CVE-2026-83844
Vendors
Microsoft
Products
PaintMicrosoft PaintWindows Paint

Coverage

oldest first · one row per article · UTC
  1. · 5d ago Hacker News · securityFirst report

    Microsoft Paint remote code execution vulnerability (CVE-2026-83844)

    Out-of-bounds read in Windows Paint allows remote code execution; Microsoft Paint versions 11.0.0.0 through 11.2605.91.0 affected.

  2. · 5d ago Cyber Security News

    Microsoft discloses Paint RCE vulnerability

    Microsoft warns of out-of-bounds read in Paint (CWE-125) enabling unauthenticated remote code execution; users must update to build 11.2609.401.0 or later.

  3. · 5d ago GBHackers

    Microsoft Paint vulnerability enables remote code execution (CVE-2026-83844)

    An out-of-bounds read in Windows Paint build 11.2609.401.0 lets unauthenticated attackers execute code remotely without interaction.

  4. · 5d ago SOCRadar

    Microsoft Paint RCE CVE-2026-83844 raises store update questions

    A new CVE in Microsoft Paint has been disclosed, raising questions about store update processes.

  5. · 5d ago The Hacker News

    Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It

    Fixed build 11.2609.401.0 is now in the Microsoft Store but Windows Update does not deliver it.

  6. · 1d ago Dark Reading

    Microsoft patches Windows Paint local RCE flaw CVE-2026-83844

    The out-of-bounds read needs local access and user interaction; Microsoft rates exploitation less likely.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-83844
Network RCE via out-of-bounds read in Windows Paint
7.0<1%PoC ×7