Security · High impactFan score 43 · Tier B2 sources57 comments in the community
Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It
The Hacker News · By info@thehackernews.com (The Hacker News) ·
A fix for CVE-2026-83844, a remote code execution flaw in Windows Paint, is now in the Microsoft Store. Paint gets this fix only through a Store update, not through Windows updates. The fixed build, 11.2609.401.0, was the newest Paint build in all ten countries The Hacker News…
The Brief
- A remote code execution vulnerability in MS Paint has been disclosed as CVE-2026-83844.
- A commenter says it affects Paint 11.0.0.0 up to, but not including, 11.2605.91.0.
- A commenter says the fix is version 11.2609.401.0.
Why it matters
Developers on Windows who run the affected Microsoft Paint versions should update, since the flaw allows code execution and is reported as remotely exploitable.
Who’s affected
- Windows users running Microsoft Paint 11.0.0.0 up to, but not including, 11.2605.91.0
What to do
- Update Microsoft Paint to version 11.2609.401.0 or later
- If Windows Update does not offer the fix, check the Microsoft Store, as one commenter reported
- MS Paint 11.2609.401.0
- CVE-2026-83844
- #security
- #windows
- #microsoft
- #vulnerability
- #rce
- #paint
What developers are saying
Based on 57 comments · Mixed reactions
Commenters on Hacker News reacted with disbelief and humour, since Paint is an unlikely target for remote code execution. Several questioned the CVSS vector, especially the no-user-interaction flag and the unclear network context. Others noted the fix was hard to get through Windows Update and compared the bug to the recent Notepad CVE.
- Disbelief about remote Paint exploit30%
- Doubts about CVSS vector20%
- Fix hard to obtain15%
- Jokes about Paint and calc20%
- Comparison to Notepad CVE10%
In favour
Concerns
- − The CVSS vector shows no user interaction, which some commenters doubt
- − The network context of the attack is unclear
- − Windows Update did not show the fix for at least one user
“UI:N it is with no interaction ? is it a cve mistake ?”
“Had to go to Microsoft Store to get the fixed version, Windows Update didn't show anything.”
“What Network?”
Timeline
Full coverage · 2 sources
- 2h ago ↗
The Hacker News
Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It
- 18h ago ↗
Hacker News: Front Page
MS Paint Remote Code Execution Vulnerability
