EN PT-BR
← Voltar ao feed
high

Microsoft Patches Windows Paint RCE CVE-2026-83844, Fix Reaches Users Only via Microsoft Store

1 fonte(s) · 1 atualização(ões) · publicado 09/11/2026 18:12 · coletado há 1 hora

Baseado só no resumo do feed. O site da fonte não liberou o texto completo para o Tifon, então esta análise saiu apenas do resumo publicado no feed e pode estar incompleta. Ela é atualizada quando outra fonte cobrir o assunto. Ler na fonte original ↗

Microsoft disclosed CVE-2026-83844 on October 13, 2026, a flaw in the Windows Paint app that can let an unauthenticated attacker run code over a network. Microsoft rates it Important with a CVSS 3.1 base score of 8.1 (thehackernews.com, citing msrc.microsoft.com). The flaw is an out-of-bounds read, and the vendor says exploiting it requires a deep understanding of the target system, which limits how easily it can be weaponized. At publication it was not known to be exploited or publicly disclosed, and it was absent from CISA's KEV catalog when checked (thehackernews.com). The fix reaches users only through the Microsoft Store, and Microsoft's own records disagree on the fixed version, which explains the weeks of confusion in the article.

Entenda a falha

A vulnerabilidade

CVE-2026-83844 is an out-of-bounds read in the Windows Paint Microsoft Store app. Microsoft rates it Important, CVSS 3.1 base score 8.1. Per the advisory, an unauthenticated attacker can reach code execution over the network with no user interaction, but the vendor says it takes a deep understanding of the target system, which makes it harder to weaponize. Paint builds below 11.2609.401.0 are affected, and that build is the fix. The CVE record and NVD still list only builds below 11.2605.91.0 as affected, which contradicts the advisory.

Como funciona

The advisory says a crafted packet sent over the network to an affected service can trigger the out-of-bounds read, which can then lead to code execution. It does not name the service, and the articles give no further detail on the internal steps. Exploitation needs neither sign-in nor user assistance.

Por que é vulnerável

The root cause is an out-of-bounds read, meaning the code reads memory beyond the bounds of the data it is handling. The articles do not explain why it went unnoticed or what the code change does. The fix ships only as a closed Microsoft Store package, with no public commit.

Como foi descoberta

The articles do not say who found the flaw or how. Microsoft disclosed it on October 13, 2026. At publication it was not known to be exploited or publicly disclosed, and it was not in CISA's KEV catalog. Patch messaging was unclear for weeks: per a Microsoft Q&A question cited by The Hacker News, the advisory first gave 11.2605.91.0 as the fixed build and later changed to 11.2609.401.0 without noting it in the revision history. Brian Vitko of RFF found that the newest Store build in six countries was 11.2605.81.0, which lacks the fix. Dark Reading reported on November 9 that Microsoft had fixed the bug after the confusion.

Explicação gerada por IA a partir da matéria e dos artigos, em 09/11/2026 19:19.

Detalhes técnicos

  • The advisory describes an out-of-bounds read that lets a crafted packet sent to an affected service over the network trigger code execution, but it does not name the service (thehackernews.com).
  • No sign-in and no user assistance are required for exploitation (thehackernews.com).
  • The CVE record and the NVD entry still list Paint as affected only below build 11.2605.91.0, which contradicts the advisory's fixed build (thehackernews.com).

Detalhes da correção

  • Microsoft's advisory names Paint build 11.2609.401.0 as the fixed version. The Microsoft Store offers this build, and Windows Update does not deliver it (thehackernews.com).
  • Brian Vitko of RFF checked six countries and found the newest Store build in each was 11.2605.81.0, which lacks the fix. His test virtual machine later moved to the fixed build through Store auto-update, but how fast other PCs will receive it is unclear (thehackernews.com).
  • No public pull request or commit for this fix was found in the pages opened; the patch is a closed Store package.

Remediação

  • Update Paint through the Microsoft Store, or let auto-update install build 11.2609.401.0. In Intune and similar tools, a Store app update scan can push it across many PCs (thehackernews.com).
  • Check every user's copy of Paint and the provisioned copy, because a check of only the signed-in account can miss older installs. Confirm every copy shows 11.2609.401.0 or later, and do not rely on the CVE record's range (thehackernews.com).
  • The advisory lists no workaround. Vitko suggested removing Paint where nobody needs it, for all users and from the provisioned copy, but he did not test that step (thehackernews.com).

Relatos divergentes

  • The article says the patch messaging was unclear. Per a Microsoft Q&A question cited by The Hacker News, the advisory gave 11.2605.91.0 as the fixed build until recently, and its revision history does not note the change (thehackernews.com). The current advisory names 11.2609.401.0 and is the more authoritative version.
  • The CVE record and NVD still list the affected range below 11.2605.91.0, so they disagree with the current advisory (thehackernews.com).

Linha do tempo

  1. darkreading.com ↗ · pub. 09/11/2026 18:12 · coletado 09/11 19:00 primeiro registro só resumo do feed

    Microsoft Patches Windows Paint RCE CVE-2026-83844, Fix Reaches Users Only via Microsoft Store

    ler a análise desta fonte

    Microsoft disclosed CVE-2026-83844 on October 13, 2026, a flaw in the Windows Paint app that can let an unauthenticated attacker run code over a network. Microsoft rates it Important with a CVSS 3.1 base score of 8.1 (thehackernews.com, citing msrc.microsoft.com). The flaw is an out-of-bounds read, and the vendor says exploiting it requires a deep understanding of the target system, which limits how easily it can be weaponized. At publication it was not known to be exploited or publicly disclosed, and it was absent from CISA's KEV catalog when checked (thehackernews.com). The fix reaches users only through the Microsoft Store, and Microsoft's own records disagree on the fixed version, which explains the weeks of confusion in the article.

    Technical Details

    • The advisory describes an out-of-bounds read that lets a crafted packet sent to an affected service over the network trigger code execution, but it does not name the service (thehackernews.com).
    • No sign-in and no user assistance are required for exploitation (thehackernews.com).
    • The CVE record and the NVD entry still list Paint as affected only below build 11.2605.91.0, which contradicts the advisory's fixed build (thehackernews.com).

    Fix Details

    • Microsoft's advisory names Paint build 11.2609.401.0 as the fixed version. The Microsoft Store offers this build, and Windows Update does not deliver it (thehackernews.com).
    • Brian Vitko of RFF checked six countries and found the newest Store build in each was 11.2605.81.0, which lacks the fix. His test virtual machine later moved to the fixed build through Store auto-update, but how fast other PCs will receive it is unclear (thehackernews.com).
    • No public pull request or commit for this fix was found in the pages opened; the patch is a closed Store package.

    Remediation

    • Update Paint through the Microsoft Store, or let auto-update install build 11.2609.401.0. In Intune and similar tools, a Store app update scan can push it across many PCs (thehackernews.com).
    • Check every user's copy of Paint and the provisioned copy, because a check of only the signed-in account can miss older installs. Confirm every copy shows 11.2609.401.0 or later, and do not rely on the CVE record's range (thehackernews.com).
    • The advisory lists no workaround. Vitko suggested removing Paint where nobody needs it, for all users and from the provisioned copy, but he did not test that step (thehackernews.com).

    Conflicting Reports

    • The article says the patch messaging was unclear. Per a Microsoft Q&A question cited by The Hacker News, the advisory gave 11.2605.91.0 as the fixed build until recently, and its revision history does not note the change (thehackernews.com). The current advisory names 11.2609.401.0 and is the more authoritative version.
    • The CVE record and NVD still list the affected range below 11.2605.91.0, so they disagree with the current advisory (thehackernews.com).