Vulnerability · high · CVSS 7
Microsoft Paint remote code execution flaw (CVE-2026-83844) disclosed and fixed
Tier B · Patch this week – Put it in the sprint
Who’s exposed: Windows users running the Microsoft Store version of Paint
Tier B because: Full takeover OR secrets exposed OR supply chain
Reach
Attack
Damage
Fix
Full takeover
What to do
- Update Paint through the Microsoft Store to build 11.2609.401.0 or later
The Brief
- Microsoft disclosed CVE-2026-83844, a remote code execution flaw in Windows Paint.
- The fix is delivered only through a Microsoft Store update, not through Windows Update.
- The fixed Paint build is 11.2609.401.0, reported as the newest Paint build in all ten countries checked.
Why it matters
Paint users who installed it from the Microsoft Store need that Store update to get the fix, and Windows Update alone will not deliver it.
The checklist behind the tier
Checklist · 2 of 10 yes
| Yes | Hits tech teams | Judgment: Paint ships as a built-in Windows app that IT teams manage and run on developer machines. |
| No | Core infrastructure | Judgment: A single bundled Windows app, not core infrastructure like OpenSSH or the Linux kernel. |
| No | Popular tool | Judgment: Paint is a mainstream bundled app but not a developer framework, tool or package. |
| No | Exploited in the wild | Sources only describe the disclosed flaw and fix; no source reports observed attacks. |
| No | Public exploit | Sources describe the flaw and fix but do not say exploit code or a PoC is published. |
| No | Remote, no login | CVSSCVSS: CVE-2026-83844 AV:L/PR:N/UI:R |
| Yes | Full takeover | CVSSCVE-2026-83844: CVSS rates confidentiality and integrity impact high |
| No | Secrets exposed | Sources report no theft or exposure of credentials, data or source code. |
| No | Supply chain | Sources describe a vulnerability and its fix; no compromised package, update or pipeline is reported. |
| No | No fix yet | The Hacker News: A fix for CVE-2026-83844 is now available in the Microsoft Store. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
CVE-2026-83844 ↗CVSS 7 high AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Windows Paint Remote Code Execution Vulnerability
- Exploited
- Not in CISA’s exploited catalog
- EPSS
- <1% chance of exploitation in the next 30 days · higher than 33% of all CVEs
- Weakness
- CWE-125
Timeline
CVE-2026-83844 disclosed
Hacker News: Front Page
MS Paint Remote Code Execution Vulnerability
Hacker News
215 points · 57 comments
Fix made available in the Microsoft Store (build 11.2609.401.0)
The Hacker News
Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It
darkreading
Microsoft Fixes RCE Bug in Windows Paint After Weeks of Confusion
Full coverage · 3 sources
- 3h ago ↗
- 4d ago ↗
- 4d ago ↗
Hacker News: Front Page
MS Paint Remote Code Execution Vulnerability
What developers are saying
Based on 57 comments · Mixed reactions
Commenters are largely incredulous that MS Paint could have a remote code execution flaw, and many joke about it. Several question the CVSS vector, especially the no-interaction score, and note that the fix arrives via the Store rather than Windows Update.
- Surprise that Paint has RCE30%
- Doubts about CVSS vector20%
- Jokes about Microsoft and old apps25%
- Store versus Windows Update delivery15%
- Air-gapped security reflections10%
In favour
- + The CVE record names a specific fixed version, 11.2609.401.0, which makes remediation clear
- + Some commenters running much older Paint versions think they may be safe
Concerns
- − Commenters question why Paint has a network component at all
- − The CVSS vector's no-interaction score looks suspicious to some commenters
- − Commenters were frustrated that Windows Update did not offer the fix
“Had to go to Microsoft Store to get the fixed version, Windows Update didn't show anything.”
“WHY ON HELL paint has a remote code execution in the name of God?”
“Paint can exectue arbitrary code from the REMOTE, without USER INTERACTION?????”
First seen · 3 sources · 57 comments · Full story page · How tiers are decided