Do Son 
TL;DR
Microsoft patched an important Windows Paint RCE flaw that carries a high 8.1 CVSS score. Tracked as CVE-2026-83844, the bug stems from an out-of-bounds read error in memory. Consequently, attackers could execute code on target PCs without user help. System users must update the app right away to block attacks.
- CVE: CVE-2026-83844
- CVSS: 8.1 (High · CVSSv3)
- Product: Microsoft Paint
- Affected: 11.0.0.0
- Impact: Windows Paint Remote Code Execution Vulnerability
- Status: No confirmed exploitation yet
- Patched in: 11.2605.91.0
- EPSS: 0.7% (30-day)
- Action: Update to 11.2605.91.0 now
Why It Matters
Microsoft Paint runs on hundreds of millions of Windows 10 and Windows 11 PCs worldwide. Therefore, any flaw in this tool opens a broad target area for attackers.
Fortunately, Microsoft reports that attackers have not used the flaw in the wild. In addition, no public exploit code exists at this time. The vendor rates real-world attacks as less likely. This is because a working attack requires high skill and deep system insight.
How the Attack Works
Out-of-Bounds Memory Read
The bug sits in how the app parses data packets and image memory (CWE-125). A remote attacker could exploit the flaw over the local network. To do so, they send a crafted packet to an affected service. As a result, the app reads past its buffer bounds. This memory error lets the attacker run arbitrary code on the host machine.
Affected Versions
This Windows Paint RCE bug affects all Microsoft Paint builds prior to version 11.2609.401.0 on modern Windows systems.
Patch and Mitigation Steps
Microsoft fixed the flaw in Paint version 11.2609.401.0. Users should open the Microsoft Store app and check the Downloads section. Then, install all pending app updates right away. In addition, enterprise admins can push the update package to all endpoints using central tools. Applying this patch stops the read error and secures the app against memory corruption.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
