CVE-2026-83844

CVSS

—

EPSS

0.007 (54.5th percentile)

CISA KEV

Not listed

Exploitation

No report

Public exploits

None seen

State

Unknown

Coverage

• 

  The Hacker News◇Specialist. Specialist publisher: established trade press, or expert analysis with a track record3 hours ago

  Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It

  A fix for CVE-2026-83844, a remote code execution flaw in Windows Paint, is now in the Microsoft Store. Paint gets this fix only through a Store update, not through Windows updates. The fixed build, 11.2609.401.0, was the newest Paint build in all ten countries The Hacker News checked today. The…

  ↗thehackernews.com/2026/11/microsoft-paint-rce-f…(opens the publisher's site in a new tab)

• Microsoft MSRC◆Authoritative. Authoritative publisher: a primary source, or a newsroom with formal editorial standards13 Oct, 14:00

  CVE-2026-83844 Windows Paint Remote Code Execution Vulnerability

  Out-of-bounds read in Windows Paint allows an unauthorized attacker to execute code over a network.

  ↗msrc.microsoft.com/update-guide/vulnerability/C…(opens the publisher's site in a new tab)

What we observed