Microsoft Paint CVE-2026-83844: Patching and Hunting

Microsoft fixed CVE-2026-83844 , a remote code execution flaw in the Windows 11 Paint app, in its October 13, 2026 security release. It is an out-of-bounds read (CWE-125), rated Important with a CVSS 3.1 score of 8.1 . Microsoft’s description says an unauthorized attacker can execute code over a network, and its FAQ says no authentication or user interaction is required.

Paint is not part of the Windows cumulative update. It is a Microsoft Store app, so installing the October Windows update does not fix it. The fix also got harder to find after release. Microsoft first named 11.2605.91.0 as the fixed build, but that build never appeared in the public Store catalog. In early November Microsoft changed the fixed build in its Security Update Guide to 11.2609.401.0 , without adding a revision note. The CVE record still shows the old cutoff.

Affected and fixed versions

Microsoft lists only the Paint app. Classic Paint on Windows 10 is not listed, and the Store package requires Windows 11 (build 22000 or later).

Why two fixed builds are in circulation

The CVE record and the original Security Update Guide entry list builds from 11.0.0.0 up to, but not including, 11.2605.91.0 as affected. Microsoft last updated the CVE record on October 31, and it still uses that cutoff.

The Security Update Guide and Microsoft’s October CVRF data now name 11.2609.401.0 as the fixed build. The vulnerability’s revision history still shows only the October 13 entry, so Microsoft has not explained the change.

The public Store catalog for Paint , as we read it on November 6, lists 11.2605.71.0 and 11.2605.81.0, then 11.2609.401.0. There is no 11.2605.91.0. That explains why administrators who updated in October could not get past 11.2605.81.0.

Because no build between the two cutoffs was ever published to the Store, both thresholds flag the same PCs in practice. Insider channel builds may fall in between, so treat anything below 11.2609.401.0 as vulnerable .

Microsoft has published only a few lines this flaw:

Type: an out-of-bounds read, where Paint reads memory past the end of a buffer while processing attacker-controlled data.

CVSS vector: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H . That is network attack vector, high attack complexity, no privileges and no user interaction.

Attack complexity: Microsoft says exploitation requires a deep understanding of the system and is not guaranteed.

FAQ: an unauthenticated attacker sends a specially crafted packet to an affected service over the network.

Paint is a desktop app that opens files. It does not normally run a network service, and Microsoft has not named a service, a port or a file format. The FAQ wording matches what Microsoft uses for network service flaws, and it does not fit how Paint usually works. In our assessment the realistic delivery path is crafted image data that reaches Paint, for example an image from a download, an email attachment or a network . Until Microsoft explains, plan for its own wording too: code execution in the context of the user running Paint, with no click beyond what Paint already does on its own.

No researcher is credited by name, no technical write-up or proof of concept has been published, and Microsoft rates exploitation less likely .

Who is exposed, in priority order

Windows 11 PCs where the Store or its app updates are blocked. Paint stays on the vulnerable build indefinitely. This is common on locked-down corporate fleets and kiosks.

PCs of users who handle images from outside the organization: marketing, design, recruitment, support and anyone who opens screenshots sent by customers.

Shared and multi-user PCs. The Store updates Paint per user profile, so one profile can be fixed while another is not.

Every other Windows 11 PC with Store updates working. Most will already be on 11.2609.401.0 or will get it within days. Check rather than assume.

How to check your PCs

On one PC , run this in an elevated PowerShell window. It only reads the installed version for each profile:

In the Paint app , open Settings and read the version under “ Paint”.

Across the fleet , use Defender Vulnerability Management, Intune app inventory or your software inventory tool, and filter for Paint below 11.2609.401.0. Hunt 1 below does this in Defender.

Do not rely on the Store saying “up to date”. Store status reflects what the Store offered that profile, not whether the build is fixed.

Mitigation and remediation

Update Paint to 11.2609.401.0 or later. In the Microsoft Store, open Downloads and select “Get updates”. To update from the command line, for example in a remediation script:

Unblock Store app updates where your policy blocks them, at least for Paint, or deploy Paint as a required “Microsoft Store app (new)” in Intune so Intune keeps it current.

Confirm the version afterwards on each PC and each user profile. Restart Paint, or the PC if asked.

Remove Paint where it is not needed and cannot be kept current, such as kiosks, servers with desktop experience and jump hosts. This is our recommendation, not a Microsoft workaround:

Treat images from outside the organization as untrusted until the update is in place. Keep Mark of the Web on downloads and attachments, and keep attachment scanning on for image types.

Microsoft publishes no workaround or mitigation for this flaw.

No exploitation has been reported, so these hunts look for the behavior an exploited Paint would show: crashes, child processes, network activity and dropped files. Paint normally does none of these beyond its own Microsoft services.

Microsoft Sentinel and Defender queries

The KQL below is example code for Microsoft Sentinel and Microsoft Defender for Endpoint. Adapt table and field names to your environment and test each query before relying on it.

Hunt 1: PCs with Paint below the fixed build

Defender Vulnerability Management lists Store apps in its software inventory. Compare the version against the new fixed build, not the CVE record’s cutoff.

If the inventory does not list Paint, read the version from the path Paint runs from:

Hunt 2: Paint starting other programs

An exploit that gets code running inside Paint will usually start a shell, a script host or a download tool. Paint itself should start almost nothing.

Any hit on cmd.exe , powershell.exe , pwsh.exe , rundll32.exe , regsvr32.exe , mshta.exe , wscript.exe , cscript.exe , curl.exe or bitsadmin.exe needs investigating straight away.

Hunt 3: Paint listening on the network or talking to unusual hosts

Paint never needs to accept inbound connections. Its AI and sign-in features talk to Microsoft services, so outbound traffic to anything else is worth a look.

Hunt 4: Paint crashing

Failed exploit attempts against an out-of-bounds read usually crash the app. A run of Paint crashes on one PC, or crashes right after an image arrived from outside, is a lead.

If you collect the Windows Application log in Sentinel, event 1000 gives the faulting module and exception code. An access violation ( 0xc0000005 ) fits a memory read past a buffer.

Hunt 5: images from outside the organization opened in Paint

This shows which users open downloaded, emailed or network images in Paint, which is where to look first if a crash or child process turns up.

Hunt 6: Paint writing executables, scripts or persistence

Paint saves images. It has no reason to write programs, scripts or shortcuts, or to touch autorun registry keys.

Responding to a suspected compromise

Isolate the PC in Defender and keep the image file that was open, the Paint crash dumps and the timeline from Hunts 2 to 6.

Update Paint to 11.2609.401.0 or remove it before reconnecting the PC.

Treat the user’s sessions as exposed. Code running in Paint runs as that user, so revoke their sign-in sessions and refresh tokens and reset the password.

Look for the same image elsewhere. mail, file shares and other endpoints for the file’s hash and name.

Rebuild the PC if Paint started a shell, wrote an executable or created persistence.

Indicators of compromise

None have been published. Microsoft has not released technical details, and no exploit or exploitation has been reported. The hunts above look for behavior rather than indicators for that reason.

October 13, 2026: Microsoft publishes CVE-2026-83844 in its October security release, with 11.2605.91.0 as the fixed build. CISA’s assessment in the CVE record: exploitation none, not automatable, total technical impact.

October 31, 2026: Microsoft updates the CVE record. The affected range still ends below 11.2605.91.0.

Early November 2026: The Security Update Guide and October CVRF data change the fixed build to 11.2609.401.0, with no new revision entry.

November 5, 2026: The Store catalog listing for Paint is updated. On November 6 it lists 11.2609.401.0 and no 11.2605.91.0.

November 6, 2026: CVE-2026-83844 is not in CISA KEV. FIRST’s EPSS gives it 0.73%.

Frequently Asked Questions

Does the October Windows update fix this? No. Paint is a Store app and updates through the Microsoft Store, separately from the Windows cumulative update.

Which version is safe? 11.2609.401.0 or later. Microsoft first said 11.2605.91.0, but that build was never published in the Store, and Microsoft now names 11.2609.401.0.

Can an attacker really exploit Paint over the network with no user action? That is what Microsoft’s description and CVSS vector say, but Paint does not normally run a network service and Microsoft has not said which service is affected. The more likely path is crafted image data reaching Paint. Patch on Microsoft’s terms either way.

Is it being exploited? No. Microsoft lists it as not exploited and not publicly disclosed, and it is not in CISA KEV.

Is Windows 10 affected? Microsoft lists only the Paint app for Windows 11. Classic Paint on Windows 10 is not listed.

Our Store says Paint is up to date, but the version is lower. What now? Check whether policy blocks Store app updates for that PC or profile, then run the winget upgrade command above or deploy Paint through Intune. Confirm the version afterwards.

Can we just uninstall Paint? Yes, on PCs where nobody needs it. Windows 11 allows Paint to be removed, and the commands are above.

How ThreatDefence is responding

ThreatDefence has added CVE-2026-83844 and the 11.2609.401.0 fixed build to our vulnerability intelligence. Where we hold Microsoft Defender and Windows telemetry, our SOC is:

identifying Windows 11 PCs with Paint below 11.2609.401.0

watching for Paint crashes, child processes, network connections and dropped files

helping customers fix Store update policies that keep Paint on old builds

Microsoft Security Response Center, CVE-2026-83844 Windows Paint Remote Code Execution Vulnerability (October 13, 2026)

Microsoft Security Response Center, October 2026 security updates CVRF data (checked November 6, 2026)

CVE Program, CVE-2026-83844 record (updated October 31, 2026)

Microsoft Store, Paint (product ID 9PCFS5B6T72H, catalog checked November 6, 2026)

CISA, Known Exploited Vulnerabilities catalog (checked November 6, 2026)

FIRST, EPSS score for CVE-2026-83844 (November 5, 2026)

Microsoft Learn, Get-AppxPackage

Microsoft Learn, Remove-AppxPackage

Microsoft Learn, winget upgrade command

Microsoft Learn, Add Microsoft Store apps to Intune

Microsoft Learn, DeviceTvmSoftwareInventory table (Defender XDR advanced hunting)