Microsoft Paint RCE CVE-2026

Socradar •Ameer Owda • November 6, 2026

Microsoft has disclosed CVE-2026-83844, an out-of-bounds read in the Microsoft Store version of Paint that could allow remote code execution. Microsoft rates the vulnerability Important, while its CVSS score of 8.1 places it in the high-severity range. Its assessment indicates a network-based attack requiring no privileges or user interaction, although successful exploitation has high complexity. […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Windows 11 Paint Vulnerability CVE-2026-83844: Patch Availability Issues Persist Microsoft disclosed a high-severity vulnerability in Windows Paint, tracked as CVE-2026-83844, on October 13, 2026. The flaw allows remote code execution via an out-of-bounds read, affecting versions prior to 11.2605.91.0. Despite Microsoft stating that a patch is available, users and IT administrators report difficulties in obtaining the updated version through the Microsoft Store, often finding older versions instead. The vulnerability has a CVSS score of 8.1, indicating a high severity. While there are no confirmed reports of exploitation, the potential for remote code execution without user interaction raises significant concerns. Administrators are advised to verify the installed version of Paint directly, as reliance on the Store for updates may not be sufficient. 29 sources 58

Extracted Entities

CVEs (1)

CVE-2026-83844

CWE Weaknesses (1)

CWE-125 - Out-of-bounds Read