Microsoft patches Paint RCE CVE-2026-83844 (CVSS 8.1); fixed-build guidance revised and Store update gaps reported
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 06/11/2026 04:02; os links antigos trazem para cá.
Fontes: gbhackers.com ↗ securityonline.info ↗
Microsoft disclosed CVE-2026-83844 on October 13, 2026 (gbhackers.com). It is a remote code execution vulnerability in Microsoft Paint on Windows 10 and Windows 11, rated Important with CVSS v3.1 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). An unauthenticated attacker could execute code remotely without user interaction, but the high attack complexity makes real-world attacks less likely (securityonline.info, gbhackers.com). There is no evidence of exploitation in the wild, no public proof-of-concept, and the CVE is not in the CISA KEV catalog (securityonline.info). The main open issue is patch confusion. Microsoft's guidance on the fixed Paint build changed after publication, and some systems reportedly cannot obtain the fix through the Microsoft Store (securityonline.info).
Entenda a falha
A vulnerabilidade
CVE-2026-83844 is a remote code execution flaw in Microsoft Paint on Windows 10 and Windows 11, an out-of-bounds read (CWE-125). Microsoft rates it Important, CVSS v3.1 8.1 (AV:N/AC:H/PR:N/UI:N). The attacker needs network reach, no privileges and no user interaction, but attack complexity is high. Success gives code execution as the user running Paint. The fixed build is disputed: the CNA record lists affected versions as 11.0.0.0 up to but excluding 11.2605.91.0, while the MSRC CVRF/API data (as of November 2) names 11.2609.401.0, which the articles treat as the target.
Como funciona
According to the articles, Paint parses data packets and image data into memory. Microsoft says an attacker could send a specially crafted packet to an affected service over the network. While parsing, the app reads past the end of its buffer. That out-of-bounds read is where processing goes wrong, and it can be turned into code execution on the host. The advisory does not identify the affected service, the network port or the detailed execution chain.
Por que é vulnerável
The root cause is improper bounds checking while Paint parses data packets and image memory, so the code reads outside the buffer it was given (CWE-125). The articles do not say why it went unnoticed. SecurityOnline says the update stops the read error and protects the app against memory corruption.
Como foi descoberta
The articles do not say who found the flaw or how. Microsoft disclosed it on October 13, 2026, through its advisory and CNA record. Microsoft reports no exploitation in the wild, rates exploitation as less likely, and the CVE is not in the CISA KEV catalog. The fixed-build guidance later changed, and users reported that the Microsoft Store kept offering older builds, which Microsoft has not confirmed in the available sources.
Explicação gerada por IA a partir da matéria e dos artigos, em 06/11/2026 04:17.
Detalhes técnicos
- The flaw is an out-of-bounds read (CWE-125) caused by improper bounds checking while Paint parses image/data packets (securityonline.info).
- Successful exploitation allows arbitrary code execution in the context of the user running the app, potentially leading to full host compromise (securityonline.info).
- Microsoft's CNA record lists affected versions as 11.0.0.0 up to, but excluding, 11.2605.91.0 (securityonline.info).
- Paint ships on hundreds of millions of Windows 10 and 11 installations, so the potential attack surface is broad (securityonline.info).
- Attack vector is network, privileges required none, user interaction none, with high attack complexity (securityonline.info, gbhackers.com).
Remediação
- Open the Microsoft Store, go to Downloads/Updates, and install any pending Paint updates (securityonline.info).
- Verify that the installed Paint version matches or exceeds the currently documented fixed build, 11.2609.401.0 per the latest MSRC guidance (securityonline.info).
- Enterprise administrators should push the update through central management tools and check the installed Paint version on each endpoint. They should not assume Windows Update alone applied the fix, given the reported Store distribution gaps (securityonline.info).
Relatos divergentes
- Fixed version: The advisory and CNA record originally named 11.2605.91.0 as the patched build (securityonline.info). As of November 2, 2026, the MSRC CVRF/API document lists 11.2609.401.0 instead (securityonline.info). The MSRC revision is the more recent and authoritative, but it has not been reconciled with the CNA's affected-version boundary, so treat 11.2609.401.0 as the target.
- Store availability: Administrators and users reported that the Microsoft Store kept offering older builds such as 11.2605.81.0 or 11.2603.251.0, below the documented threshold, so some systems could not get the fix (securityonline.info). This is user-reported and not confirmed by Microsoft in the available sources.
- gbhackers.com gives no fixed-version information.
Linha do tempo
-
Microsoft Paint Vulnerability Allows Hackers to Execute Malicious Code Remotely Without User Interaction
ler a análise desta fonte ocultar
Microsoft has announced a vulnerability in Windows Paint that could let unauthenticated attackers execute malicious code remotely without any user interaction. This vulnerability is tracked as CVE-2026-83844 and was disclosed on October 13, 2026.
It carries an “Important” severity rating from Microsoft, and its CVSS 3.1 base score is 8.1, indicating potentially serious consequences, despite the high complexity involved in successfully exploiting it.
-
Microsoft Patches High-Severity Windows Paint RCE (CVE-2026-83844) Amid Patch Confusion
ler a análise desta fonte ocultar
Microsoft disclosed and patched CVE-2026-83844, a remote code execution vulnerability in Microsoft Paint caused by an out-of-bounds read (CWE-125) that occurs while the app parses image/data packets. Microsoft rates the flaw Important, CVSS v3.1 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no privileges or user interaction are required but exploitation requires high attack complexity, which the vendor says makes real-world attacks less likely. Microsoft Paint ships on hundreds of millions of Windows 10 and Windows 11 installations, giving the flaw a broad potential attack surface, but there is no evidence of exploitation in the wild, no public proof-of-concept, and the CVE is not listed in the CISA KEV catalog (rootaccessguy.com).
Technical Details
The vulnerability stems from improper bounds checking during image/data parsing inside Microsoft Paint, allowing a successful attacker to execute arbitrary code in the context of the user running the app, potentially leading to full host compromise (sentinelone.com). Microsoft's CNA record lists affected versions as 11.0.0.0 up to, but excluding, 11.2605.91.0 (startuphub.ai, rootaccessguy.com).
Fix Details
Microsoft's remediation guidance for the fixed build changed after initial publication: the advisory originally named 11.2605.91.0 as the patched version, but as of November 2, 2026 the official MSRC CVRF/API document instead lists 11.2609.401.0 as the fixed Microsoft Paint build, a change that has not yet been reconciled with the CNA's affected-version boundary (rootaccessguy.com). Compounding the confusion, administrators and users reported that the Microsoft Store continued distributing older builds such as 11.2605.81.0 or 11.2603.251.0, below the documented patched-version threshold, leaving some systems unable to obtain the actual fix despite checking for updates (windowsreport.com, mallory.ai).
Remediation
Users and administrators should open the Microsoft Store, check the Downloads/Updates section, and install any pending Paint app updates, verifying afterward that the installed version matches or exceeds the currently documented fixed build (11.2609.401.0 per MSRC's latest guidance). Enterprise administrators should push the update via central management tools and explicitly verify the installed Paint version on endpoints rather than assuming Windows Update alone has applied the fix, given the reported Store distribution gaps.
Conflicting Reports
The article states the update target is 11.2605.91.0, reflecting Microsoft's initial advisory. Microsoft's own Security Update Guide was subsequently revised to list 11.2609.401.0 as the fixed build (rootaccessguy.com), a discrepancy multiple outlets also noted amid user reports that even updated systems were left on unpatched versions (windowsreport.com).