CVE-2026-83844: Windows Paint RCE and Version Checks

CVE-2026-83844 is a High-severity Windows Paint remote code execution vulnerability affecting Microsoft Paint versions from 11.0.0.0 up to, but not including, 11.2605.91.0. Microsoft’s CVE record describes an out-of-bounds read and assigns CVSS 3.1 8.1. The record was published on October 13, 2026 and updated October 31; a query spike in November is not evidence that the vulnerability was disclosed today. Microsoft security advisory .

See Penligent in action

What the official record does and does not establish

The phrase “over a network” and the network CVSS vector should not be rewritten as a claim that Paint is a server. Remote delivery can still require the application to process attacker-controlled content. Until Microsoft publishes more mechanism detail, defenders should avoid inventing a file extension, preview path or user-interaction condition. Microsoft CNA record .

Check the installed Paint version

Paint is serviced as an application package, so the Windows OS build alone is not the correct evidence. Run the check in an elevated PowerShell session when fleet-wide visibility is required:

Compare the Version value with 11.2605.91.0. A value lower than the boundary is affected according to the CVE record. Record devices where no matching package is present separately from devices where inventory collection failed.

Update paths for individual and managed devices

Do not close the ticket because the Store reports that an update was assigned. Verify the package on the endpoint. Devices can miss an application update because of user context, Store restrictions, stale VDI images, failed content delivery or long-running sessions.

Verify the corrected version is active

Re-run the PowerShell inventory and confirm Paint is 11.2605.91.0 or later.

Confirm the updated package applies to every user or device context in scope.

Close and reopen Paint or refresh the managed session so an old process is not retained.

Open a benign test image through the normal enterprise workflow and confirm required editing and export functions still work.

Reconcile devices that are offline, excluded, failed or missing from management telemetry.

Detection and incident review boundaries

An affected version proves remediation is required; it does not prove compromise. If incident response is warranted, preserve relevant file-delivery, browser, email, endpoint and application-crash telemetry. Do not label a crash or an image attachment as exploitation without corroborating evidence. Microsoft’s public record does not provide a signature or unique malicious filename.

For CVE-2026-83844, the fastest defensible workflow is package inventory, managed application update, active-version verification and exception reconciliation. Keep the affected Paint version separate from the Windows OS build, and keep confirmed Microsoft facts separate from attack details that have not been published.

Explore Penligent for authorized security testing and evidence-based validation .