CVE-2026-83844: Windows Paint RCE With Conflicting Fixed-Version Reports
A Windows Paint out-of-bounds read can lead to code execution over a network. It scores 8.1 and is not known to be exploited, but the reported fixed build differs by source. Here is who is affected and how to update.
Microsoft published CVE-2026-83844, a remote code execution flaw in the Windows Paint app, on October 13, 2026. It scores 8.1 High and carries no KEV entry, and CISA's SSVC data lists exploitation as none. What is unsettled is the fix: the CVE record names Paint 11.2605.91.0, while Cyber Security News reports a different build in Microsoft's advisory.
How the flaw works
Microsoft's description is one sentence: an out-of-bounds read in Windows Paint allows an unauthorized attacker to execute code over a network. The weakness is CWE-125, a memory error where software reads past the end of the data it was given.
Microsoft's CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N, which means a network attack vector, high attack complexity, no privileges and no user interaction, with high impact on confidentiality, integrity and availability. That gives 8.1 High. The same record marks exploit code maturity as Unproven and the fix as official.
What is missing is the attack path. Cyber Security News writes that a crafted image could trigger the flaw, yet the Microsoft guidance it quotes describes a crafted network packet sent to an affected service, and it says neither the exposed service nor the full path is identified. Treat the trigger as unconfirmed.
Who is affected
The CVE record lists Microsoft Paint from 11.0.0.0 up to, but not including, 11.2605.91.0. Microsoft delivers the fix as a Microsoft Store update for Paint, so the version on a device follows Store updates and not the Windows build number.
VulnTracker flags 11.0.0.0 as a likely placeholder start, which makes the fixed build the reliable boundary, and that boundary is the disputed part (next section). CERT-Bund advisory WID-SEC-W-2026-3922, dated October 15, 2026, lists five affected Microsoft apps, according to VulnTracker.
The fixed build is in dispute
Two build numbers are in circulation. The CVE record, updated October 31, 2026, sets the affected range as below 11.2605.91.0, so 11.2605.91.0 is the fix. VulnTracker's remediation draws the same boundary from the Microsoft advisory.
Cyber Security News, writing on November 6, tells a different story. It says Microsoft first listed 11.2605.91.0, that administrators reported the Microsoft Store still offering 11.2605.81.0, and that Microsoft's advisory now lists 11.2609.401.0 as the fix, which suggests the earlier number may have been wrong. It adds that Microsoft has not confirmed this and that reports of Store availability are inconsistent and unverified.
The MSRC page renders only in a browser, so this post could not read its text, and the advisory itself is the tiebreaker. Until it is checked, a device on 11.2605.91.0 may or may not be fixed, while any build at or above 11.2609.401.0 satisfies both readings.
Reading it on VulnTracker
The header strip shows High 8.1, EPSS 0.7%, SSVC No known exploit and a No fix recorded badge. That badge appears because the CVE record has no fixes entry, not because Microsoft shipped nothing. The SSVC panel reads No known exploit, Not automatable, Total impact, and the CVSS panel shows the 8.1 vector from Microsoft.
In the Affected section, the VulnTracker VTDB tab lists Microsoft Paint at 11.0.0.0 with 90% confidence, the MITRE CNA tab shows one entry, and the NVD CPE tab is empty. An amber note under Remediation says the 11.0.0.0 value looks like a placeholder and that the fixed version comes from the Microsoft advisory, not from the record. Under Vendor advisories (2), the Microsoft MSRC entry sits next to CERT-Bund WID-SEC-W-2026-3922, rated High with five apps affected. The remediation steps are AI-generated and published by VulnTracker, so check the build number in them against the advisory.
What to do
- Open the MSRC advisory for CVE-2026-83844 in a browser and note the fixed Paint build it lists today.
- List the installed Paint version on every Windows device with your endpoint inventory or app management tool.
- Update Paint through the Microsoft Store. Where Store updates are disabled or managed centrally, push the update through your app-management tooling.
- Aim for 11.2609.401.0 or later if the advisory names it, since that also covers 11.2605.91.0. If the Store only offers an older build, record the device and retry after the Store catches up.
- Verify the version after rollout and follow up on devices that are offline or blocked from Store updates.
There is no known exploitation, so a normal app-update cycle fits, but the flaw is network-reachable by description, so do not leave Paint on old builds.
Takeaway
CVE-2026-83844 is an 8.1 High network RCE in a Store app with no known exploitation, and the open question is which Paint build actually fixes it. Confirm the number in the Microsoft advisory, update every device to that build or newer, and track Microsoft Paint on VulnTracker so a corrected fixed version or an exploitation change reaches you when the record updates.
References
Related reading
October 2026 Patch Tuesday: A Record Release and One Exploited Windows Shell Bug
Microsoft's October 2026 Patch Tuesday is the largest ever, with roughly 1,400 fixes. One Windows Shell flaw, CVE-2026-96951, was exploited and has an October 16 CISA deadline. Here is what to patch first.