Microsoft Paint flaw could enable remote code execution

Microsoft has disclosed CVE-2026-83844, a CWE-125 out-of-bounds read in the Microsoft Store version of Paint that could enable remote code execution over a network. The vulnerability has an CVSS score of 8.1 and is classified as Important. Microsoft notes a network-based attack that requires no privileges or user interaction, although exploitation is described as of high complexity and dependent on environmental and configuration factors.

The flaw has not been publicly disclosed, with Microsoft stating no known exploitation to date and exploitability as Exploitation Less Likely. The vulnerability is associated with the Paint Store app, meaning patch status may vary between the Windows OS and the Paint package delivered via the Store.

Affected versions and verification guidance are explicit. The CVE record lists Microsoft Paint 11.0.0[.]0 through versions below 11.2605.91.0 as affected, while the current Security Update Guide build is 11.2609.401.0. The practical verification target is to confirm 11.2609.401.0 or later on each endpoint. The Store delivery means an updated Windows image is not a guarantee that all Paint instances are patched; organisations should verify the installed Paint version across user profiles and provisioned packages.

Defenders are advised to update Paint via the Store to build 11.2609.401.0 or later, verify every user context, review provisioned packages and monitor for unusual Paint behaviour such as spawning shells, unexpected network activity, or executable writes.

For verification, the article provides commands to check installed and provisioned Paint versions:

Get-AppxPackage -AllUsers -Name Microsoft[.]Paint | Select-Object Name, Version

Get-AppxProvisionedPackage -Online | Where-Object DisplayName -eq 'Microsoft[.]Paint' | Select-Object DisplayName, Version