CVE-2026-83844 hits Microsoft Paint

Microsoft Paint is affected by CVE-2026-83844, a vulnerability rated CVSS 8.1 that, according to the technical description published by Neowin, is an out-of-bounds read capable of enabling network-based code execution. Windows Latest also reported that users and administrators had trouble receiving the corrected version through Microsoft Store, even with automatic updates enabled.

What is known about the Paint flaw?

The issue is described as an out-of-bounds read in Microsoft Paint and has been linked to remote code execution over the network. Neowin identified it as CVE-2026-83844 and assigned it a CVSS score of 8.1. The coverage available also described it as a no-click bug, meaning it does not require user interaction, although the material does not provide additional independent official confirmation of that scope.

What problems were reported getting the patch?

Windows Latest said the corrected version of Paint was not reaching users consistently through Microsoft Store. According to that coverage, the issue appeared even on systems with automatic updates turned on. Mallory.ai summarized the same situation by noting that Windows 11 updates do not necessarily update Microsoft Paint separately, so users should check the installed version and not rely only on the operating system.

What do the versions say about the scope of the fix?

Penligent published a technical analysis that attributes to the CVE record an affected range for Microsoft Paint from version 11.0.0.0 up to before 11.2605.91.0, with a CVSS 3.1 score of 8.1, though it clarified that its result does not allow direct verification of the original record. WindowsForum, for its part, documented an apparent change in the advisory. It said that 11.2605.91.0 was first circulated as the fixed version, but a Microsoft CVRF or API document dated November 2 reportedly changed that to 11.2609.401.0.

Are there reports of active exploitation?

The available coverage showed no reports of exploitation in practice, according to Windows Latest. That point was presented as a lack of observed cases, not as definitive confirmation that the flaw is not being used. The material reviewed also does not include an independent official notice that closes that question.