Short answer: Microsoft fixed a security issue in Paint, but only through the Store. Users should update Paint to the latest version.
TL;DR
- Microsoft fixed a critical flaw in Paint.
- The fix is only available through the Store.
- Check and update Paint to the latest version.
- The flaw could allow code execution over a network.
What is CVE-2026-83844?
A security issue in Microsoft Paint allows an attacker to run code over the network. This fix is only available in the Microsoft Store, not through regular Windows updates. Users should update Paint to the latest version to protect their systems.
- RCE (remote code execution)
- An attacker can run their own commands on someone else's computer or server over the internet.
- Vulnerability
- A mistake or weakness in software that an attacker can misuse.
- Exploit
- Code or steps that take advantage of a weakness.
Key facts
| Reported by | The Hacker News |
|---|---|
| Date reported | 06 Nov 2026 |
| CVE | CVE-2026-83844 |
| CVSS | 8.1 HIGH CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Weakness | CWE-125 (out-of-bounds read) |
| CISA KEV | Not listed (no confirmed exploitation in KEV) |
| Affected product | Microsoft Paint |
| Published in NVD | 2026-10-13 (CVE-2026-83844) |
How it works
An attacker sends a special packet to an affected service over the network, exploiting a flaw in Windows Paint. This could allow the attacker to run code over a network, leading to a security risk.
- Attacker reaches the Microsoft Paint over the internet / network
- No login or account is needed
- Sends crafted input that triggers the out-of-bounds read flaw
- Impact: data can be read, data or code can be changed, service crashes or stops
Skillmate analyst mapping (our judgement, not from the vendor):
- T1190 Exploit Public-Facing Application
Timeline
| Date | Event | Source |
|---|---|---|
| 2026-10-13 | CVE-2026-83844 published in NVD | NVD |
| 2026-11-06 | Reported by The Hacker News | The Hacker News |
| 2026-11-06 | This Skillmate explainer published | Skillmate |
Am I affected?
These commands only read the version or settings. Compare the output with the vendor advisory linked in the facts table.
Microsoft Windows
PowerShell: lists the latest installed updates:
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10shows the Windows version and build:
winverHow to fix it
- Update Microsoft Paint to the fixed release named in the vendor advisory.
- If you cannot patch today, limit who can reach the affected service and watch its logs.
How to detect it
Look for network activity related to Paint.
What is confirmed and what is not
| Confirmed | Not confirmed yet |
|---|---|
| CVE-2026-83844 is a real NVD record scored 8.1 HIGH | CISA KEV does not list CVE-2026-83844 as exploited in the wild |
| Reported by The Hacker News | NVD links no vendor advisory for CVE-2026-83844 yet |
| Reported by learn.microsoft.com |
Why it matters
This flaw could let attackers run code over a network, posing a significant security risk. Companies and users must ensure Paint is updated to protect against potential attacks. Students should learn to stay vigilant and keep software up-to-date.
Learn the skills behind this story
Want to understand attacks like this and defend against them? Join Skillmate cybersecurity training or practise hands-on in Skillmate Labs.
FAQ
What is the CVSS score for CVE-2026-83844?
The CVSS score for CVE-2026-83844 is 8.1, which is high.
Can the fix for Paint be applied through Windows Update?
No, the fix is only available through the Microsoft Store.
Is the fixed version of Paint widely distributed?
The fixed version, 11.2609.401.0, is available in newer builds of Paint, but not all versions have been updated yet.
Related Skillmate posts
Sources
- Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It (The Hacker News)
- Microsoft (primary source) (learn.microsoft.com)
- NVD CVE record (NVD)
How we wrote this: facts come from the sources above, NVD and CISA KEV. An on-prem AI model drafted the plain-English parts and every sentence was checked against the sources; unsupported sentences were removed. MITRE mapping is our own judgement.
