CVE-2026-83844: Windows 11 Paint RCE (CVSS 8.1), fixed build unclear, how to check your version

Microsoft's Windows Paint has a remote code execution flaw, CVE-2026-83844, scored 8.1 (High) on the CVSS 3.1 scale, and the confusing part is not the bug but the fix: the patched build is delivered through the Microsoft Store rather than Windows Update, administrators report they cannot find it, and Microsoft's own records name two different fixed versions. A fully patched Windows 11 PC can therefore still be running a vulnerable Paint. This article explains what is known, how to check your version in one PowerShell line, and what is still unclear.

Key points

• CVE-2026-83844 is an out-of-bounds read (CWE-125) in Windows Paint that Microsoft says "allows an unauthorized attacker to execute code over a network"; it was published on 13 October 2026.
• The CVSS 3.1 base score is 8.1 (High): network attack vector, high attack complexity, no privileges and no user interaction required, high impact on confidentiality, integrity and availability.
• Microsoft's CVE record lists Paint versions from 11.0.0.0 up to, but not including, 11.2605.91.0 as affected, while a later report says the Microsoft Security Response Center (MSRC) data now names 11.2609.401.0 as the fixed build.
• Paint is updated through the Microsoft Store, so a Windows cumulative update does not fix it, and several administrators report that the patched build does not show up for them.
• As of the sources below (5 November), none reports exploitation in the wild, and CISA's coordinator entry records "none" for exploitation.

What to do

Who is affected: Microsoft Paint on Windows 11 below the fixed build. Microsoft's CVE record gives 11.2605.91.0 as the cut-off; MSRC's current guidance, as reported by the sites we cite, points to 11.2609.401.0. Use the higher number as your target.

Check your version. Open PowerShell and run:

Get-AppxPackage -Name Microsoft.Paint | Select-Object Name, Version

From an elevated session, add -AllUsers to include other profiles. The command only reads the installed version; it changes nothing. How to read the result, following the WindowsForum write-up that collected the reports:

• 11.2609.401.0 or higher: meets MSRC's current target.
• Between 11.2605.91.0 and 11.2609.401.0: meets the older threshold in the CVE record but not the newer one. Treat it as unconfirmed.
• Below 11.2605.91.0 (for example 11.2605.81.0 or 11.2603.251.0, both versions reported by users): vulnerable under either threshold.

Get the update. Open the Microsoft Store, go to Library and choose "Get updates". Because the Store may say "up to date" while an older build is installed, trust the PowerShell output, not the Store's status. Windows Latest, quoted by WindowsForum, suggests installing whatever newer Paint build the Store offers even if it is below the documented fix, on the reasoning that a newer build beats an old one while Microsoft sorts out the documentation. That is the outlet's advice, not Microsoft's.

Workarounds. Microsoft has not published an official workaround. Suggestions from third parties, none tested against this bug according to the sources below: do not open unexpected image files in Paint, restrict untrusted image attachments in mail, remove Paint on machines where nobody needs it, and, as SentinelOne is quoted as recommending, change file associations so untrusted image formats open in a hardened or sandboxed viewer.

What happened

Microsoft's CVE numbering authority published the record for CVE-2026-83844 on 13 October 2026, titled "Windows Paint Remote Code Execution Vulnerability". The description is one sentence: an out-of-bounds read in Windows Paint allows an unauthorized attacker to execute code over a network. The weakness is classed CWE-125, a read of memory outside the buffer the code is supposed to use. The National Vulnerability Database entry, created the same day, repeats the description and the 8.1 score from Microsoft, and showed the status "Undergoing Analysis" when we checked on 6 November.

The vector string in the record is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Read plainly, that is network reachable, high attack complexity, no privileges, no user interaction, with total impact on the data and the system. Microsoft's own record adds temporal values showing that no exploit code was known (E:U), that an official fix exists (RL:O) and that the report is confirmed (RC:C). Microsoft's record was last updated on 31 October 2026.

The same day, CISA's coordinator added its SSVC assessment to the record: exploitation "none", automatable "no", technical impact "total". In plain terms: no known exploitation, not something that can be fired off at scale automatically, but a full compromise if it works.

Background: why a drawing app has a network bug

Paint's job is to parse image files, and image parsers are a classic home for memory-safety bugs: a file that lies about its own dimensions or chunk lengths can make careless code read, or write, outside its buffer. An out-of-bounds read by itself usually leaks memory or crashes the program. Turning one into code execution normally needs a second weakness or a careful memory layout, which fits the "High" attack complexity rating Microsoft assigned.

Paint is also no longer part of the core operating system image. Like Notepad, the Snipping Tool and Photos, it is a Store-delivered inbox app. That means it follows its own release train, outside the monthly Patch Tuesday cumulative updates that many organisations measure compliance by. Teams that track "patched" as "the right KB number is installed" can miss a vulnerable inbox app entirely.

The timeline

The reports we reviewed, mostly collected by WindowsForum from Neowin, Windows Latest, Techzine and a site called Rootaccessguy, describe this sequence. We could not open the Microsoft Security Response Center page itself, which needs JavaScript, so details about its contents are second-hand and labelled as such.

• 13 October: Microsoft publishes the advisory and the CVE record. The fixed version in the record is 11.2605.91.0.
• 30 October: A user on Microsoft Q&A says they cannot find 11.2605.91.0 through any Store channel; the newest they can see is 11.2605.81.0. The only reply, from another community member and not from Microsoft, guesses it might be a typo.
• 31 October: Microsoft's CVE record is last updated, and still says versions below 11.2605.91.0 are affected.
• 2 November: Rootaccessguy reports that the MSRC's CVRF/API document dated that morning lists 11.2609.401.0 as the fixed build, replacing 11.2605.91.0.
• 5 November: Windows Latest says its own test PC had Store auto-updates on, showed no pending Paint update, and was still on 11.2603.251.0. Administrators on Reddit told the outlet they could not find the update even after pulling the app package with a third-party tool.

Why the target changed is unconfirmed. Techzine suggests the first number looks like a typo. One user says the package is only available in South Asian regions, and Rootaccessguy noticed that the Store link's region changed from US to SG, which fits a regional rollout but does not prove one. Windows Latest suggests Microsoft may have pulled the update or listed a version that does not exist. Microsoft has not confirmed any of these explanations, so treat all of them as speculation.

The numbers

• 8.1: CVSS 3.1 base score (High). Microsoft's severity label for the bug, according to Windows Latest as quoted by WindowsForum, is "Important", one step below "Critical".
• 0.65% to 0.73%: the EPSS exploitation-probability estimate for the CVE moved from 0.65% on 14 October to 0.73% on 4 November, according to the CVEtodo tracker as cited by WindowsForum. EPSS is a model's estimate of the chance of exploitation in the next 30 days, so this is low.
• Not in CISA KEV: Rootaccessguy found the CVE absent from the Known Exploited Vulnerabilities catalogue, in a copy dated 30 October with 1,766 entries. KEV only lists confirmed exploitation, so absence means none confirmed as of that date, not none exists.

These are snapshots. They describe the position on their dates, and none of them means an unpatched machine is safe.

What it means

For ordinary users: the realistic risk comes from opening image files you did not expect. Until you have confirmed your Paint version, treat unsolicited image attachments with suspicion, and do not open them in Paint. 9to5Windows makes the same point and adds that some image-parser bugs fire when File Explorer generates a thumbnail, though nothing in Microsoft's description says this one does.

For administrators: do not rely on the Store's "up to date" message, and do not assume the Windows cumulative update covers inbox apps. If you scan with a tool that reads the CVE record, it will use the 11.2605.91.0 cut-off and may mark machines compliant that MSRC's newer guidance says are not. Inventory with Get-AppxPackage across devices and use 11.2609.401.0 as the conservative target. Where Paint has no business use, such as kiosks and locked-down task workers, removing it removes the attack surface.

For the industry: the episode shows a servicing gap. Store-delivered inbox apps now carry real CVEs with scores that would get an operating-system component an emergency change window, yet they sit outside the patching workflow most organisations built around Patch Tuesday.

What we don't know yet

• How the bug is triggered. Techzine and Windows Report, as summarised by WindowsForum, describe a specially crafted image. SentinelOne's database attributes the root cause to bounds checking during image parsing. Windows Latest quotes MSRC wording about "a specially crafted packet to an affected service over the network", which mentions no image at all. Microsoft has not published an exploitation chain, and nothing public names a service or port.
• Whether user interaction is needed. The CVSS vector says none, but 9to5Windows notes that exploiting a Paint flaw normally means getting a victim to open a malicious file. The scoring and the practical picture do not obviously agree.
• The correct fixed version, and whether the patched build is available worldwide.
• Whether anyone is exploiting it. No source we found reports exploitation, but absence of reports is thin evidence for a bug that is hard to trigger and hard to patch.

What to watch next

Watch for an MSRC correction that reconciles the two version numbers, an update to the CVE record that moves its cut-off to 11.2609.401.0, a statement on regional availability, and any change to the CISA entry or the KEV catalogue. If exploit code appears, the fact that few machines can get the patched build would make the risk larger, not smaller.

Sources

• CVE record for CVE-2026-83844 (MITRE CVE Services, Microsoft CNA data)
• NVD entry for CVE-2026-83844
• Microsoft Security Response Center advisory (page needs JavaScript; we could not read it, referenced by the CVE record)
• 9to5Windows: Microsoft Paint Vulnerability CVE-2026-83844 Lets Hackers Take Over Windows 11
• WindowsForum: CVE-2026-83844, Windows 11 Paint RCE fix confusion and how to check your version (collects the Neowin, Windows Latest, Techzine and Rootaccessguy reports cited above)