Microsoft’s Security Update Guide lists a Windows Paint RCE, CVE-2026-83844, and says exploitation needs no authentication and no user interaction. It is an out-of-bounds read in Microsoft Paint that lets an unauthorized attacker execute code over a network. Microsoft published the fix on 13 October 2026 as a Store app update.
MSRC rates it Important, with a CVSS 3.1 base score of 8.1 and a temporal score of 7.1. There is no CVSS 4.0 score in the MSRC entry, the CVE record or NVD. Its flags read Publicly Disclosed: No and Exploited: No, and it assesses exploitation as less likely. The attack complexity is high, so success is not guaranteed.
What Does Microsoft Say About the Windows Paint RCE?
MSRC describes the attack as an unauthenticated attacker sending a specially crafted packet to an affected service over the network. The CVSS vector is network-based, high complexity, no privileges and no user interaction. MSRC explains that high complexity means the attacker needs a deep understanding of the system and that results depend on the environment and configuration.
The record does not say which service receives the packet, or on which Windows versions Paint runs it. Because of that, treat the “zero-click” label as Microsoft’s description of the CVSS vector, not as a finding about how easy an attack is. The reporter is credited as Anonymous.
CISA’s entry in the CVE record lists exploitation as none, not automatable, with total technical impact. The flaw is not in the CISA KEV catalogue version 2026.11.04. NVD showed the record as Undergoing Analysis, and the CVE record was last updated on 31 October 2026.
Which Paint Builds Are Fixed?
| Item | What the sources say |
|---|---|
| Product | Microsoft Paint, delivered through the Microsoft Store |
| Affected builds in the CVE record | 11.0.0.0 up to, but not including, 11.2605.91.0 |
| Fixed build in MSRC remediation | 11.2609.401.0, as a security update from the Store |
| Restart needed | Maybe, according to MSRC |
| Weakness | CWE-125, out-of-bounds read |
The CVE record and MSRC give different version numbers. We recommend the newest Paint build from the Store, which is at least the build MSRC names as fixed.
What Should You Do Now?
MSRC marks customer action as required. The steps below follow its Store remediation, and steps 3 and 4 are our advice.
- Update from the StoreOpen the Microsoft Store, check for app updates and install the Paint update. MSRC says the fix is a Store security update.
- Confirm the buildCheck that Paint is at 11.2609.401.0 or later. Anything below 11.2605.91.0 is in the affected range of the CVE record.
- Inventory managed devicesWhere the Store is blocked or updates are staged, use your software inventory to list Paint builds and push the update.
- Keep to the normal patch cycleMSRC says exploitation is less likely and not yet seen, so update on your regular cycle but do not leave it open.
The October fixes are part of the month’s release, which our Patch Tuesday archive tracks. For the processes behind these steps, see patch management and the glossary entry on remote code execution.