Windows 11 Paint RCE Flaw CVE-2026-83844 Patched

Executive Summary

Microsoft has patched CVE-2026-83844, a remote code execution (RCE) vulnerability in the Microsoft Paint application on Windows 11. The vulnerability is rated as 'Important' with a CVSS 3.1 score of 8.1. According to the advisory, a successful exploit could allow an unauthenticated, remote attacker to execute arbitrary code with no user interaction required. The flaw is an out-of-bounds read (CWE-125). In a departure from standard procedure, the fix is not part of a cumulative Windows update but must be installed by updating the Paint application through the Microsoft Store. Microsoft assesses exploitation as 'less likely' and has seen no evidence of active exploitation in the wild.

Vulnerability Details

CVE-2026-83844 is an out-of-bounds read vulnerability in how the Microsoft Paint application handles certain data. An attacker could potentially craft a malicious file or data stream that, when processed by Paint, triggers the flaw and leads to arbitrary code execution. The high CVSS score is driven by the 'Network' attack vector, 'Low' attack complexity, and 'None' for privileges and user interaction required, making it a potentially dangerous flaw if a reliable exploit were developed.

Affected Systems

• Product: Microsoft Paint app for Windows 11
• Affected Versions: All versions below 11.2609.401.0

There was initial confusion regarding the patched version. Microsoft's original advisory on October 13, 2026, mentioned build 11.2605.91.0, but this version was never released publicly. A revision on November 6 clarified that version 11.2609.401.0 is the first official build containing the fix.

Exploitation Status

As of November 7, 2026, Microsoft has stated that the vulnerability has not been publicly disclosed or exploited. The Exploit Prediction Scoring System (EPSS) gives it a low probability score of 0.73%, suggesting that developing a working exploit may be difficult. However, given its potential for unauthenticated RCE, security teams should not underestimate the risk.

Impact Assessment

If successfully exploited, an attacker could execute code in the context of the user running the Paint application. While this may not immediately grant administrative privileges, it provides a critical foothold on the target system.

• Initial Access: An attacker could use this vulnerability to gain initial access to a workstation, for example, by tricking a user into opening a malicious image file or through a drive-by download scenario.
• Malware Deployment: Once code execution is achieved, the attacker can deploy further malware, such as spyware, ransomware, or credential stealers.
• Lateral Movement: The compromised machine could be used as a pivot point to move laterally within the network.

Cyber Observables — Hunting Hints

To identify vulnerable systems or potential exploitation attempts, security teams can use the following hints:

Detection Methods

1. Version Checking: The most reliable detection method is to check the version of the Microsoft Paint application on all Windows 11 endpoints. This can be done via PowerShell or endpoint management tools.

   Get-AppxPackage Microsoft.Paint | Select-Object -ExpandProperty Version
   

2. Process Monitoring: Use an EDR solution to monitor the mspaint.exe process. Alert on any suspicious behavior, such as spawning cmd.exe or powershell.exe, making network connections to unusual IPs, or writing executable files to disk. This is a form of Process Analysis.

Remediation Steps

1. Update from Microsoft Store: The primary remediation is to update the Microsoft Paint application to version 11.2609.401.0 or later. This must be done through the Microsoft Store app.
   • Open the Microsoft Store.
   • Go to the 'Library' section.
   • Click 'Get updates' and install the update for Paint.
2. Automated Updates: For enterprises, ensure that Microsoft Store for Business policies are configured to automatically deploy updates for store apps to all managed endpoints. This is a crucial Software Update process.
3. Application Control: As a compensating control, organizations with strict security postures could use application control solutions like AppLocker or Windows Defender Application Control to restrict the execution of mspaint.exe if it is not a business-critical application.