CVE-2026-838448.1High
CVE-2026-83844: Windows Paint Remote Code Execution Vulnerability
Microsoft · Microsoft Paint
Vendor fix available · Affected: Microsoft Paint · Exploitation: not established
ExploitationNot established
Not in CISA KEV as of catalogue 2026.11.04 (4 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not establishedNothing in the sources we check
0.7%probability of exploitation in the next 30 days
54th percentile
050100
Higher than 54% of scored CVEs
8.1HighCVSS
LowMediumHighCrit.
DescriptionNVD
Out-of-bounds read in Windows Paint allows an unauthorized attacker to execute code over a network.
Coverage3 articles · 3 outlets
One row per outlet, in order of first report. First in our coverage: SecurityOnline, 6 Nov.
Developinglatest 2 hours ago3 articles3 outlets
- Fri 6 Nov, 04:30 UTC. SecurityOnline, first report. Microsoft fixes remote code execution flaw in Windows Paint.
- Fri 6 Nov, 09:30 UTC. SOCRadar, its first report on the story. Microsoft Paint flaw could enable remote code execution.
- Fri 6 Nov, 13:30 UTC. The Hacker News, its first report on the story. Microsoft Paint RCE fix arrives through Store, not Windows Update.
- First report
- Article
- Running total
Show as tableHide table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| 6 Nov 04:30 | SecurityOnline | Microsoft fixes remote code execution flaw in Windows Paint |
| 6 Nov 09:30 | SOCRadar | Microsoft Paint flaw could enable remote code execution |
| 6 Nov 13:30 | The Hacker News | Microsoft Paint RCE fix arrives through Store, not Windows Update |
- Microsoft fixes remote code execution flaw in Windows PaintSecurityOnline · first in our coverage
New articles also arrive in the RSS feed.