Microsoft Patches Windows Paint RCE Vulnerability After Fix Timeline Confusion

Summary

Microsoft patched CVE-2026-83844, a high-severity Windows Paint out-of-bounds read that can enable local code execution. The fixed version is 11.2609.401.0; Microsoft reported no exploitation to date.

Key points

CVE-2026-83844 is an out-of-bounds read in Windows Paint that Microsoft says can allow an unauthorized attacker to execute code locally.
The vulnerability has a CVSS 3.1 score of 7.0 and requires local access and user interaction, according to the updated advisory.
Microsoft reported no known exploitation and characterized exploitation as less likely.
The fixed Paint version is 11.2609.401.0, available through the Microsoft Store.
The fix timeline was unclear: the correct version appeared in the advisory by Nov. 4 but was not available in the store until Nov. 6.
The advisory’s earlier network-attack wording and CVSS 8.1 score were changed; Microsoft has not provided further details about the vulnerability’s trigger.