Microsoft Fixes RCE Bug in Windows Paint After Weeks of Confusion

Last month, Microsoft disclosed a vulnerability in Microsoft Paint, but messaging regarding a patch was unclear.

Microsoft recently patched a remote code execution (RCE) vulnerability in Windows Paint, though details regarding how to fix the flaw seemingly remained unsettled for nearly a month.

According to an advisory, the flaw, CVE-2026-83844, is an “out-of-bounds read in Windows Paint [that] allows an unauthorized attacker to execute code locally.” It carries a high severity CVSS 3.1 score of 7.0.

The advisory offers few technical details for defenders. Microsoft said acquiring RCE requires local access, meaning hands-on-keyboard or a direct remote connection to the attacker’s machine. Some user interaction is also required; altogether, this may explain why the attack is “only” high severity rather than a 9 or 10 CVSS, as is so often associated with RCE flaws. Microsoft has observed no exploitation reports to date, further marking exploitation as “less likely.”

A Windows Paint patch is available now. The fixed version is 11.2609.401.0, and customers can see it under Paint > Settings > About.

A Microsoft spokesperson tells Dark Reading, “A security update for Paint is available through the Microsoft Store, and customers with automatic Store updates enabled are already protected. We recommend customers check they are on the latest version and install the available updates to remain protected.” Customers can also manually apply the update via Microsoft Store App > Downloads > Check for updates.

A Curious Timeline for a Windows Paint CVE

CVE-2026-83844 is an unusual vulnerability for multiple reasons, beyond it being a high-severity Paint vulnerability capable of RCE.

As Brian Vitko, founder of device management software provider RFF, wrote in a blog post, Microsoft first disclosed the bug on Oct. 13, but there seemed to be no indication the reported fix (11.2605.91.0) was live, even as of Oct. 30. By Nov. 4, Vitko, the correct fixed version was listed in the security advisory (11.2609.401.0) but 11.2605.81.0 was the latest update available in the store. The correct version was added to the store on Nov. 6.

The original version of the advisory FAQ, according to Vitko’s post, said the attack could possibly be exploited, “by sending a specially crafted packet to an affected service over the network.”

But the latest version of the FAQ reads, “For example, when the score indicates that the Attack Vector is Local and User Interaction is Required, this could describe an exploit in which an attacker, through social engineering, convinces a victim to download and open a specially crafted file from a website which leads to a local attack on their computer.”

Vitko tells Dark Reading that this latter explanation aligns more with his expectations for a vulnerability targeting Windows Paint, and that the wording may just be the result of standardized Microsoft FAQ language than speaking directly to the vulnerability.

“Paint isn’t something that listens on the network. When it was published, it was CVSS 8.1 with a network attack vector, and the FAQ talked about ‘a specially crafted packet to an affected service over the network.’ Microsoft changed that on Nov. 7: it’s now 7.0, local, user interaction required, and the FAQ says an attacker ‘convinces a victim to download and open a specially crafted file from a website,'” he says. “That makes a lot more sense for an image editor. Microsoft hasn’t said anything more about the actual trigger.”

Dark Reading asked Microsoft for additional information regarding the update timeline.