CVE-2026-83844: Windows Paint Remote Code Execution, Explained

Nobody worry-surfs their patch notes for Microsoft Paint. It is the app you open to crop a screenshot, the one that has shipped with Windows since 1985, and the last thing most security teams have on a watchlist. Which is exactly why CVE-2026-83844 is worth fifteen minutes of your attention: an out-of-bounds read in Windows Paint that can let an unauthenticated attacker execute code over a network, scored 8.1 HIGH on CVSS 3.1 and patched in Microsoft's October 2026 release.

Here's what the record actually says, how a memory bug in a paint program earns a network attack vector, whether you should be worried, and what it teaches developers about attack surface.

What the CVE Record Says

The essentials from the CVE record and Microsoft's MSRC advisory:

Bug class: CWE-125, out-of-bounds read — code reading memory past the end of a buffer.
Impact: Remote code execution. Microsoft's description: it "allows an unauthorized attacker to execute code over a network."
Affected product: Microsoft Paint, versions 11.0.0.0 up to (excluding) 11.2605.91.0 — the modern, Store-delivered Paint on Windows 11.
CVSS 3.1: 8.1 HIGH — vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Network vector, no privileges, no user interaction, but high attack complexity; full impact to confidentiality, integrity, and availability.
Microsoft severity: "Important" (not Critical), with a temporal score of 7.1 reflecting that no exploit exists and an official fix does.
Exploitation status: Not publicly disclosed, no known exploitation at publication. CISA's vulnrichment assessment: exploitation "none," automatable "no," technical impact "total."
Fixed: Paint 11.2605.91.0, released with the October 2026 Patch Tuesday drop (public disclosure October 13, 2026).

Anatomy of the Score: 8.1 HIGH but "Important"?

The apparent mismatch between a CVSS of 8.1 (HIGH band) and Microsoft's severity rating of "Important" is the most instructive detail in this CVE, and it lives inside two letters of the vector string: AC:H — high attack complexity.

Microsoft's own FAQ for this vulnerability explains it plainly: successful exploitation "requires an attacker to have a deep understanding of the system," and success "is not guaranteed and depends on a combination of factors that might include the environment, system configuration, and the presence of additional security measures." In other words: the impact ceiling is total (C:H/I:H/A:H — the "total" in CISA's assessment), but the path to that ceiling is narrow, fragile, and conditional.

That's why the base score of 8.1 comes with a temporal score of 7.1: the E:U (no known exploit) and RL:O (official fix available) modifiers pull real-world risk down. It's also why Microsoft's exploitability assessment for the latest software release reads "Exploitation Less Likely." This is a bug to patch promptly, not a fire drill — unless your threat model says otherwise.

How an Out-of-Bounds Read Becomes Code Execution

CWE-125 sounds almost harmless — the program reads a few bytes it shouldn't. In many cases an out-of-bounds read is "only" an information leak: crash, or a glimpse of adjacent memory. So how does a read bug in Paint end up filed as remote code execution?

Three things matter. First, where the read lands: in a large C/C++ codebase, an out-of-bounds access on attacker-controlled indices can walk far past its buffer, corrupting adjacent structures or feeding garbage into later logic that does write. Second, what wraps the read: image parsers do arithmetic on dimensions, color tables, and compression headers straight from the file; a malformed value that passes one validation and detonates in another stage is the classic origin of parser memory corruption. Third, the ecosystem around it: modern mitigations (ASLR, DEP/NX, Control Flow Guard, heap hardening) make exploitation harder, which is precisely the gap between a maximally-scored impact and Microsoft's pragmatic "Important" rating.

The blunt lesson is older than Paint: code that parses untrusted input is security-critical code, no matter how boring the app around it.

The Network-Vector Question

Paint has no listening port. It isn't a service. So how does this CVE carry a network attack vector (AV:N) with no privileges and no user interaction?

Microsoft's FAQ describes the attack as "sending a specially crafted packet to an affected service over the network," with no authentication or user interaction required — but the record doesn't name the service or the delivery mechanism, and no public technical write-up exists yet (the bug was coordinated-disclosed, not publicly revealed). The practical interpretation most defenders are working with: the vulnerable parsing code sits in a component that can receive remotely-sourced content — a crafted image arriving through a chat client, download, clipboard sync, or preview pipeline — and "network" in the CVSS sense reflects that the malicious data can originate from the network, with the parse happening in Paint's code path.

Treat that as analysis, not established fact: the honest answer is that the precise delivery route isn't documented publicly. What is certain from the record: the input is attacker-controlled, the vector is network-reachable, and no click is required in the scored scenario. For defenders, that combination means the update matters even for machines where nobody ever opens Paint voluntarily.

Are You Affected, and the Fix

Check your Paint version. Affected: 11.0.0.0 and later, before 11.2605.91.0. In Paint, open Settings (or check App list versions via Settings → Apps). Fixed: 11.2605.91.0 or newer.

Because modern Paint ships through the Microsoft Store, the fix arrives via Store updates rather than a classic Windows Update KB in many setups. That has real operational consequences: managed environments that pin Store apps, block the Store, or lag on Store sync can silently hold vulnerable versions. If you run fleets:

Inventory Paint versions the way you inventory browsers — it's an app that parses files users receive from the network.
Confirm Store auto-updates are enabled, or push 11.2605.91.0+ through your Store-management pipeline (Intune/WSFB).
Verify after patching: version string ≥ 11.2605.91.0.

If you can't patch yet

No official workarounds ship with this advisory — Microsoft's guidance is the update itself. Until 11.2605.91.0+ reaches a machine, the practical damage control is narrowing the delivery routes: treat unexpected image attachments from unknown senders as hostile (standard advice that this CVE makes concrete), keep Paint out of automated preview pipelines on high-value accounts where practical, and prioritize the update for machines used by administrators and developers — where executed code pays off most for an attacker. None of that substitutes for the patch; with high attack complexity already working in your favor, these steps just narrow the path further.

What Developers Should Take From This

There is no "too boring to matter" code. The app everyone uses to crop screenshots carries the same memory-safety obligations as a browser.
File-format parsers are a privileged attack surface. Every decoder that consumes dimensions, offsets, and lengths from the file is one malformed header away from CWE-125 (or its nastier sibling, CWE-787 out-of-bounds write). Fuzz your parsers like they're internet-facing — because functionally, they are.
Memory safety is the structural fix. Decades of Windows CVEs in this family trace to C/C++ pointer arithmetic. Modern Paint is partially .NET/WinUI, but the parsing core that produced this CVE isn't memory-safe. Rust — or even a hardened, well-fuzzed C++ parser — changes the bug classes you ship.
Score the ceiling and the path separately. CVSS says what's possible; AC:H, temporal metrics, and CISA's SSVC say what's likely. Patch to the ceiling, prioritize by the path.

And when you're dissecting suspicious files yourself, keep the tooling client-side: Formatho's Base64 decoder lets you safely peek at encoded payloads, the JSON linter validates document structure before you trust a parser with it, and the JWT debugger inspects token claims without shipping secrets to a third-party site — all in your browser.

Frequently Asked Questions

Is CVE-2026-83844 being exploited in the wild?

No. Microsoft reports it was not publicly disclosed and is not known to be exploited; CISA's assessment lists exploitation as "none" and automatability as "no." High attack complexity makes opportunistic exploitation unlikely.

Which versions of Paint are affected?

Microsoft Paint 11.0.0.0 and later, before 11.2605.91.0 — the modern Windows 11 Paint app. Version 11.2605.91.0 (October 2026) contains the fix.

How do I get the patch?

Paint updates through the Microsoft Store. Open Store → Library → Get updates, or verify your device received the October 2026 update wave. Managed fleets should push the Store package explicitly if Store auto-update is restricted.

How serious is it really — 8.1 sounds alarming?

The base score prices in worst-case impact (full CIA compromise over the network with no interaction). The mitigating context: high attack complexity, no public technical details, no exploit, and an official fix. Patch promptly; don't panic.

Could this affect earlier Windows versions with classic Paint?

The record scopes the affected product to modern Microsoft Paint (11.x, the Store app era). No classic Windows 7-era Paint versions are listed in the CVE's applicability.

Conclusion

CVE-2026-83844 won't be the flashiest vulnerability of 2026, but it's a clean reminder of three durable truths: every parser of untrusted data is attack surface, CVSS ceilings and real-world likelihood are different numbers, and "it's just Paint" is not a threat model. Update to 11.2605.91.0 or later, make sure your fleet's Store updates actually flow, and give the boring apps the same security respect as the browsers.