Microsoft has released a fix for CVE-2026-83844, a vulnerability in its built-in Paint graphics editor that could allow attackers to execute malicious code on a computer. Initially rated 8.1 on the CVSS scale, the flaw was believed to enable remote attacks without authentication or user interaction. However, the company later clarified the conditions required for exploitation.
The vulnerability, tracked as CVE-2026-83844, falls under the CWE-125 category, known as Out-of-bounds Read. It occurs when a program attempts to read data beyond the boundaries of an allocated memory region. Such a flaw can expose sensitive information and, under certain conditions, allow an attacker to execute arbitrary code.
Microsoft initially rated the vulnerability at 8.1 on the CVSS 3.1 scale. The original description suggested that remote code execution could be achieved through a specially crafted network packet. The attack reportedly required no credentials, authentication, or user interaction, such as clicking suspicious links.
At the same time, Microsoft classified the vulnerability as Important and assessed exploitation as unlikely. This was primarily due to the attack’s high complexity, which required detailed knowledge of the target system. The potential consequences were considered serious, including compromises to data confidentiality, integrity, and availability.
Following the initial disclosure, Microsoft revised the technical details of CVE-2026-83844. According to updated OpenCVE data, the company lowered the vulnerability’s CVSS 3.1 score from 8.1 to 7.0 on November 7.
The most significant change concerns how the vulnerability can be exploited. While it was initially described as a remote attack requiring no user interaction, the updated record now specifies a local attack vector and the need for user interaction. The attack complexity remains high.
Despite the revised score, the vulnerability is still classified as high severity. Successful exploitation could result in data compromise, unauthorized modifications, or disruption of normal system operations.
Microsoft has not reported any confirmed cases of this specific vulnerability being exploited in real-world attacks. Based on the available information, exploitation remains unlikely, although this does not eliminate the potential risks to vulnerable computers.
Microsoft Paint has a security vulnerability that could let hackers run malicious code on your PC over a network.
The flaw, tracked as CVE-2026-83844, is rated 8.1 (High) and could allow attackers to execute code over a network without permission.
Microsoft has published a… pic.twitter.com/q1WiiFFbxD
— Pirat_Nation 🔴 (@Pirat_Nation) November 5, 2026
To address the vulnerability, Microsoft released an update for its Paint graphics editor. According to the official Microsoft Security Response Center advisory, the fix is included in version 11.2609.401.0. Earlier versions of the application, starting from 11.0.0.0, are considered vulnerable.
Microsoft recommends checking the installed version of Paint rather than relying solely on Windows updates. This is important because updating the operating system does not necessarily mean that the graphics editor has received the required security fix. Users can check the installed version in Paint’s settings and, if necessary, update the application through the Microsoft Store.
The vulnerability was reported to Microsoft by an anonymous security researcher through the company’s official vulnerability disclosure channel. Microsoft has not revealed the researcher’s identity or provided additional details about how the flaw was discovered.
The Paint vulnerability serves as another reminder that even basic, built-in Windows applications can contain serious security flaws. Users should check their installed version of Paint and ensure that the security update has been applied.
