- The Hacker News said CVE-2026-83844 is a Windows Paint out-of-bounds read that could enable remote code execution over a network.
- The Hacker News said the fixed Paint build is 11.2609.401.0, delivered through the Microsoft Store rather than Windows Update.
- Microsoft said the flaw was not known to be exploited or publicly disclosed when it published the issue on October 13.
Microsoft made a fixed Windows Paint build available through the Microsoft Store for CVE-2026-83844, getrff.com reported on Nov 4. The Hacker News said the fix is delivered through a Store update rather than Windows Update.
The Hacker News said the flaw is an out-of-bounds read that could let an attacker run code over a network. Microsoft’s advisory said exploitation could involve sending “a specially crafted packet to an affected service over the network,” with no sign-in or user assistance required.
Microsoft rated the vulnerability Important and assigned it a CVSS score of 8.1 at publication. It said the flaw was not known to be exploited or publicly disclosed when it published the issue on October 13.
On this page
Paint build 11.2609.401.0 replaced the earlier Store package
Brian Vitko found that the Store offered Paint version 11.2605.81.0 in the United States, United Kingdom, Germany, Australia, India and Singapore on Nov 5. The same catalog query returned version 11.2609.401.0 for the United States, United Kingdom and Germany on Nov 6.
The Hacker News said version 11.2609.401.0 was the newest Paint build in all ten countries it checked. Windows Report said Windows 11 users reported that they could not find the patched version in the Store.
Microsoft changed the CVSS score to 7.0 on November 7
Microsoft changed the CVSS score from 8.1 to 7.0 on November 7, with the attack vector listed as local and user interaction required. It called the change “an informational change only”.
Public records list different affected-build details
The public CVE record still lists Paint as affected only below 11.2605.91.0, the build Microsoft named at publication, while Microsoft’s security data names 11.2609.401.0. NVD has no version data yet and its entry is still “Undergoing Analysis”.
Security.nl said the update appeared on October 13, but administrators drew attention to it after complaints on Reddit that downloading the patch was difficult.
The Store catalog showed Paint version 11.2609.401.0 for the United States, United Kingdom and Germany on Nov 6, after listing version 11.2605.81.0 across six countries on Nov 5.
The version information remains inconsistent across public sources. The public CVE record lists Paint as affected below 11.2605.91.0, while Microsoft’s security data names 11.2609.401.0, and NVD has no affected-version configuration and marks its entry “Undergoing Analysis”.
FAQ
What is CVE-2026-83844?
The Hacker News said it is an out-of-bounds read flaw in Windows Paint that could let an attacker run code over a network.
Which Paint version fixes CVE-2026-83844?
The Hacker News said the fixed build is Paint 11.2609.401.0. Microsoft’s revised bulletin told users to update to that version or verify that automatic updating installed it.
Does Windows Update deliver the Paint fix?
No. The Hacker News said the fix is delivered through a Microsoft Store update rather than Windows Update.
Has CVE-2026-83844 been exploited?
Microsoft said the flaw was not known to be exploited or publicly disclosed when it published the issue on October 13.
Can the Paint flaw be exploited without a login or click?
Microsoft said the attack requires no sign-in and no user assistance. Its advisory described a specially crafted packet sent to an affected service over the network.
Sources
- Windows Paint CVE-2026-83844: the fixed build is in the Microsoft Store now. Check your fleet, Brian VitkoPrimary
- Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It, The Hacker News
- Microsoft Paint Security Flaw Could Let Hackers Execute Malicious Code, but the Fix Is Hard to Find, Windows Report
- Microsoft Paint flaw lets hackers take control remotely, Cybernews
- Microsoft publiceert wegens RCE-lek nieuwe versie Windows Paint, security.nl
How we checked this story
| Claim | Source | Status |
|---|---|---|
| The Hacker News said cVE-2026-83844 is a remote code execution flaw in Windows Paint. | The Hacker News | Attributed |
| The Hacker News said the Paint fix is delivered through a Microsoft Store update rather than Windows Update. | The Hacker News | Attributed |
| The Hacker News said the fixed Paint build is 11.2609.401.0. | The Hacker News | Attributed |
| Microsoft rated the flaw Important and assigned it a CVSS score of 8.1 at publication. | Microsoft, via The Hacker News | Attributed |
| Microsoft changed the CVSS score from 8.1 to 7.0 on November 7 and described the change as informational. | Microsoft | Attributed |
| The flaw was not known to be exploited or publicly disclosed when Microsoft published it. | Microsoft, via The Hacker News | Attributed |
| The Hacker News said the flaw is an out-of-bounds read that could let an attacker execute code over a network. | The Hacker News | Attributed |
| Microsoft’s advisory says an attacker could exploit the flaw by sending a specially crafted packet to an affected service over the network. | Microsoft, via The Hacker News | Attributed |
| Microsoft said the attack requires no sign-in and no user assistance according to the advisory. | Microsoft, via The Hacker News | Attributed |
| Windows 11 users reported that they could not find the patched Paint version in the Microsoft Store. | Windows Report | Attributed |
| Cybernews reported that the flaw enables remote code execution without clicks or logins. | Cybernews | Attributed |
| security.nl said the update appeared on October 13 but attracted attention this week after administrators complained on Reddit that downloading the patch was difficult. | security.nl | Attributed |
| Microsoft’s revised bulletin told users to update Paint to version 11.2609.401.0 or verify that automatic updating installed it. | Microsoft | Attributed |
| Brian Vitko found that the Store offered Paint version 11.2605.81.0 in six countries on November 5. | Brian Vitko | Confirmed |
| The Store catalog returned Paint version 11.2609.401.0 for the United States, United Kingdom and Germany on November 6. | Brian Vitko | Confirmed |
| The CVE record initially listed Paint as affected below 11.2605.91.0, while Microsoft’s security data named 11.2609.401.0. | Brian Vitko | Confirmed |
| NVD had no affected-version configuration and marked its entry Undergoing Analysis. | Brian Vitko | Confirmed |
| getrff.com published its report on Nov 4, 2026. | getrff.com | Confirmed |
Could not verify
- Whether the flaw has been exploited in the wild is not established.
- How many Windows systems or Paint installations are affected is not established.
- Whether the network-packet description and the specially crafted image description refer to the same trigger is not established.
- Whether CVE-2026-83844 has an additional final authoritative CVSS vector is not established.
Related stories
Vulns & PatchesCitrix discloses critical NetScaler zero-days after exploitation reports
Vulns & PatchesPTC Windchill and FlexPLM flaw could enable remote code execution
Vulns & PatchesN-able takes hosted N-central offline after researcher discloses flaws