Windows Paint Remote Code Execution Vulnerability (CVE-2026-83844)

Windows Paint Remote Code Execution Vulnerability (CVE-2026-83844)

November 2026

Overview

CVE-2026-83844 is an out-of-bounds read vulnerability in Microsoft Paint that can allow an unauthorized attacker to execute code. Microsoft rates the issue as Important. The fixed version is available through the Microsoft Store only and is not delivered by Windows Update.

What Is Affected

Microsoft Paint versions prior to 11.2609.401.0 are affected. The fixed build is 11.2609.401.0 or later. Because Paint is a Microsoft Store app, the update must come through the Store rather than Windows Update.

Risk

An attacker who successfully exploits the vulnerability can run code on the affected system. Microsoft has indicated that exploitation requires a deep understanding of the target environment and has assessed exploitation as less likely. No public exploitation was reported at the time the advisory was published. The weakness is an out-of-bounds read (CWE-125).

What You Should Do

• Open the Microsoft Store and check for updates. Install any available update for Paint.
• Confirm the installed version is 11.2609.401.0 or higher. You can check the version in the Microsoft Store under Library, or with PowerShell using Get-AppxPackage -Name Microsoft.Paint.
• If you manage multiple devices, verify the update on every user account. Store apps are installed per user, so one account may be updated while another is not.

Additional Notes

Windows Update will not install the fix for this vulnerability. Only a Microsoft Store update will bring Paint to version 11.2609.401.0 or later. After the Store update is installed, a restart may be required.