Microsoft has patched CVE-2026-83844, an out-of-bounds read in the Paint application for Windows 10 and Windows 11 that carries a CVSS score of 8.1 and an Important severity rating. Two outlets describing the advisory say an unauthenticated attacker could achieve remote code execution, although no attacks or public exploit code have been reported.
What CVE-2026-83844 Does in Microsoft Paint
The vulnerability is classified as CWE-125, an out-of-bounds read. According to SecurityOnline and Cybernews, an unauthenticated attacker could send a crafted packet to trigger remote code execution without any user click.
Microsoft rates the flaw Important and judges exploitation less likely, because carrying out the attack requires detailed knowledge of the target system. SecurityOnline states that Paint runs on hundreds of millions of Windows PCs, which gives the flaw a broad potential install base.
CVE-2026-83844 Exploitation Status and EPSS Score
No exploitation in the wild and no public exploit code have been reported. SecurityOnline cites an EPSS score of 0.7 percent over 30 days, a low probability estimate for exploitation activity in the short term. The attack also requires network access to the vulnerable component, which narrows the practical exposure.
Conflicting Reports on the Paint Fixed Build Number
The sources disagree on which Paint build contains the fix. SecurityOnline’s summary box lists build 11.2605.91.0, while the same outlet’s article text and Cybernews both give 11.2609.401.0. The 11.2609.401.0 figure appears in two places across the coverage, and Cybernews advises users to verify that build and not assume Windows Update has applied the fix.
How Microsoft Paint Receives Store Updates
Paint updates through the Microsoft Store, and enterprise environments can deploy the update using management tools.
Why a Paint Flaw Draws Attention
Paint is a built-in Windows application, and few users consider it part of their attack surface. The vulnerability class, a read beyond buffer bounds, is a memory-safety issue that can in some cases be developed into code execution. Both sources describe remote code execution as the potential outcome, though Microsoft’s own assessment that exploitation is less likely reflects the conditions an attacker would have to meet.
Crafted-Packet Attack Conditions for the Paint Flaw
The flaw is described as reachable through a crafted packet and as not requiring user interaction. At the same time, Microsoft’s note about needing detailed system knowledge suggests that a working exploit would not be trivial to build. The sources do not explain which network service or protocol would carry the packet to Paint, and the available coverage offers no technical write-up of the underlying code path.
CVE-2026-83844 Disclosure Timeline and Patch Status
The advisory and coverage were published on Nov. 6. Microsoft has not been reported to have seen attacks using the flaw, and neither source cites a researcher credit or a proof of concept.
For organizations that manage Windows fleets, the practical question raised by the coverage is version verification: the two build numbers named in the reports matter for confirming that a machine is protected. The Cybernews recommendation to check for 11.2609.401.0 specifically follows from that discrepancy.
With no active exploitation and a low EPSS estimate, the flaw sits in the category of patched but not yet observed in attacks. The broad install base is the main factor keeping it in the news, along with the unusual combination of a consumer drawing application and a remote code execution rating.
Severity Rating and Microsoft’s Exploitability Assessment
Microsoft labels the flaw Important, and the 8.1 CVSS score reflects the potential for remote code execution, while the company’s exploitability assessment weighs against near-term attacks. Both reporting outlets put the advisory date at Nov. 6, and neither describes a researcher credit or a coordinated disclosure timeline. Paint on Windows 10 and 11 is the only affected product named.
