Microsoft Patches High-Severity Windows Paint RCE (CVE-2026-83844) Amid Patch Confusion
Microsoft disclosed and patched CVE-2026-83844, a remote code execution vulnerability in Microsoft Paint caused by an out-of-bounds read (CWE-125) that occurs while the app parses image/data packets. Microsoft rates the flaw Important, CVSS v3.1 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no privileges or user interaction are required but exploitation requires high attack complexity, which the vendor says makes real-world attacks less likely. Microsoft Paint ships on hundreds of millions of Windows 10 and Windows 11 installations, giving the flaw a broad potential attack surface, but there is no evidence of exploitation in the wild, no public proof-of-concept, and the CVE is not listed in the CISA KEV catalog (rootaccessguy.com).
Entenda a falha
A vulnerabilidade
CVE-2026-83844 is a remote code execution flaw in Microsoft Paint on Windows 10 and Windows 11, an out-of-bounds read (CWE-125) in the code that parses image/data packets. Microsoft rates it Important, CVSS 8.1 (AV:N/AC:H/PR:N/UI:N). An attacker needs no privileges and no user interaction, but high attack complexity. Success gives code execution in the context of the user running Paint. The fixed version is disputed: the CNA record lists affected builds as 11.0.0.0 up to but excluding 11.2605.91.0, while the MSRC CVRF/API data was later revised to name 11.2609.401.0 as the fixed build. SecurityOnline says builds before 11.2609.401.0 are affected.
Como funciona
Paint receives image or data packets and parses them into memory buffers. According to SecurityOnline, an attacker on the network could send a crafted packet to an affected service. While parsing, the app reads past the end of the buffer it is working with. That out-of-bounds memory access is the point where processing goes wrong, and the articles say it can be turned into arbitrary code execution on the host.
Por que é vulnerável
The root cause is improper bounds checking while parsing image/data content in Paint, so the code reads memory beyond the buffer it was given. The articles do not say why it went unnoticed. SecurityOnline says the update stops the read error and protects the app against memory corruption.
Como foi descoberta
The articles do not say who found the flaw or how. Microsoft disclosed and patched it through its CNA record and Security Update Guide. Microsoft reports no exploitation in the wild, and the CVE is not in the CISA KEV catalog.
Explicação gerada por IA a partir da matéria e dos artigos, em 06/11/2026 00:16.
Detalhes técnicos
The vulnerability stems from improper bounds checking during image/data parsing inside Microsoft Paint, allowing a successful attacker to execute arbitrary code in the context of the user running the app, potentially leading to full host compromise (sentinelone.com). Microsoft's CNA record lists affected versions as 11.0.0.0 up to, but excluding, 11.2605.91.0 (startuphub.ai, rootaccessguy.com).
Detalhes da correção
Microsoft's remediation guidance for the fixed build changed after initial publication: the advisory originally named 11.2605.91.0 as the patched version, but as of November 2, 2026 the official MSRC CVRF/API document instead lists 11.2609.401.0 as the fixed Microsoft Paint build, a change that has not yet been reconciled with the CNA's affected-version boundary (rootaccessguy.com). Compounding the confusion, administrators and users reported that the Microsoft Store continued distributing older builds such as 11.2605.81.0 or 11.2603.251.0, below the documented patched-version threshold, leaving some systems unable to obtain the actual fix despite checking for updates (windowsreport.com, mallory.ai).
Remediação
Users and administrators should open the Microsoft Store, check the Downloads/Updates section, and install any pending Paint app updates, verifying afterward that the installed version matches or exceeds the currently documented fixed build (11.2609.401.0 per MSRC's latest guidance). Enterprise administrators should push the update via central management tools and explicitly verify the installed Paint version on endpoints rather than assuming Windows Update alone has applied the fix, given the reported Store distribution gaps.
Relatos divergentes
The article states the update target is 11.2605.91.0, reflecting Microsoft's initial advisory. Microsoft's own Security Update Guide was subsequently revised to list 11.2609.401.0 as the fixed build (rootaccessguy.com), a discrepancy multiple outlets also noted amid user reports that even updated systems were left on unpatched versions (windowsreport.com).
Linha do tempo
-
Microsoft Patches High-Severity Windows Paint RCE (CVE-2026-83844) Amid Patch Confusion
ler a análise desta fonte ocultar
Microsoft disclosed and patched CVE-2026-83844, a remote code execution vulnerability in Microsoft Paint caused by an out-of-bounds read (CWE-125) that occurs while the app parses image/data packets. Microsoft rates the flaw Important, CVSS v3.1 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no privileges or user interaction are required but exploitation requires high attack complexity, which the vendor says makes real-world attacks less likely. Microsoft Paint ships on hundreds of millions of Windows 10 and Windows 11 installations, giving the flaw a broad potential attack surface, but there is no evidence of exploitation in the wild, no public proof-of-concept, and the CVE is not listed in the CISA KEV catalog (rootaccessguy.com).
Technical Details
The vulnerability stems from improper bounds checking during image/data parsing inside Microsoft Paint, allowing a successful attacker to execute arbitrary code in the context of the user running the app, potentially leading to full host compromise (sentinelone.com). Microsoft's CNA record lists affected versions as 11.0.0.0 up to, but excluding, 11.2605.91.0 (startuphub.ai, rootaccessguy.com).
Fix Details
Microsoft's remediation guidance for the fixed build changed after initial publication: the advisory originally named 11.2605.91.0 as the patched version, but as of November 2, 2026 the official MSRC CVRF/API document instead lists 11.2609.401.0 as the fixed Microsoft Paint build, a change that has not yet been reconciled with the CNA's affected-version boundary (rootaccessguy.com). Compounding the confusion, administrators and users reported that the Microsoft Store continued distributing older builds such as 11.2605.81.0 or 11.2603.251.0, below the documented patched-version threshold, leaving some systems unable to obtain the actual fix despite checking for updates (windowsreport.com, mallory.ai).
Remediation
Users and administrators should open the Microsoft Store, check the Downloads/Updates section, and install any pending Paint app updates, verifying afterward that the installed version matches or exceeds the currently documented fixed build (11.2609.401.0 per MSRC's latest guidance). Enterprise administrators should push the update via central management tools and explicitly verify the installed Paint version on endpoints rather than assuming Windows Update alone has applied the fix, given the reported Store distribution gaps.
Conflicting Reports
The article states the update target is 11.2605.91.0, reflecting Microsoft's initial advisory. Microsoft's own Security Update Guide was subsequently revised to list 11.2609.401.0 as the fixed build (rootaccessguy.com), a discrepancy multiple outlets also noted amid user reports that even updated systems were left on unpatched versions (windowsreport.com).