CVE-2026-83844
CVSS 8.1 HIGH: out-of-bounds read in Windows Paint allows an unauthorized attacker to execute code over a network. Microsoft patch: Store App.
Vulnerabilities & Exploits
The Hacker News reports Microsoft has fixed an out-of-bounds read in Windows Paint, CVE-2026-83844, with a Microsoft Store update to build 11.2609.401.0; Windows Update does not deliver it.
Paint is installed separately for each Windows account, and Windows keeps a provisioned copy for new accounts. Updating the active user’s copy can leave another older copy on the machine. The Hacker News says Microsoft’s advisory names 11.2609.401.0 as fixed, while the CVE record still labels builds below 11.2605.91.0 as affected; scanners using that lower threshold may call an older build fixed.
On fleets where Windows Update success or CVE-range scans stand in for inventory, a passing result can coexist with an older Paint copy. Store availability varied by country earlier in the week, and the broader rollout timing remained unclear.
2 sources · Nov 6
CVSS 8.1 HIGH: out-of-bounds read in Windows Paint allows an unauthorized attacker to execute code over a network. Microsoft patch: Store App.
The Hacker News
Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It
Microsoft Store now offers Paint 11.2609.401.0 to fix CVE-2026-83844, an RCE flaw; Windows Update does not deliver the fix.
originalNCSC-NL Advisories
Kwetsbaarheid verholpen in Windows Paint van Microsoft
Microsoft heeft een kwetsbaarheid verholpen in Windows Paint.
originalPart of the PlainSec briefing for 2026-11-06
Every edition of this story: Paint’s Store-only fix leaves patch checks uncertain