Microsoft’s Windows Paint vulnerability, CVE-2026-83844, could allow an unauthenticated attacker to execute code over a network without user interaction.
The flaw carries a CVSS score of 8.1, placing it in the High severity category rather than Critical. However, confusion over the corrected Paint version has complicated patch checks for Windows administrators.
The vulnerability stems from an out-of-bounds read, a memory error in which software reads beyond its intended boundary.
Microsoft published the advisory on October 13, 2026. Its assessment lists a network attack vector, no required privileges, and high attack complexity, meaning successful exploitation depends on conditions that make an attack harder to carry out.
Windows 0-Click Paint RCE Vulnerability
The disclosure formed part of the October update cycle, covered in Cybersecurity News’ Microsoft October Patch Tuesday report. For administrators, the immediate concern is not simply whether an update exists, but whether the corrected application build has actually reached managed devices.
Microsoft initially listed Paint version 11.2605.91.0 as the fixed release. Administrators reported that Microsoft Store continued offering 11.2605.81.0, even after update checks and Store cache resets.
Microsoft’s advisory listed 11.2609.401.0 as the fix, suggesting the earlier version reference may have been incorrect. Microsoft has not confirmed that explanation.
Update availability also appears inconsistent. Some administrators reported difficulty obtaining a corrected build, while one participant in the Reddit discussion said the update had become available through Microsoft Store. These individual reports do not establish a universal rollout status. Claims that availability depends on region also remain unverified.
A crafted image could trigger the flaw, but Microsoft’s quoted guidance describes a crafted network packet sent to an affected service. The Hacker News discussion highlights the missing detail: neither the exposed service nor the complete attack path is identified. Suggestions involving Copilot or other components are speculation.
Administrators should check the installed Paint version rather than trust an “up to date” message alone. Neowin recommends following Microsoft’s current advisory and considering temporary removal where Paint is unnecessary. Restricting untrusted images may reduce general exposure, but it is not a confirmed fix for this specific network attack path.
Cybersecurity News’ separate PNG vulnerability coverage provides related context on image software security. Those flaws are separate from this Paint vulnerability.
Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.
