I’M UNDER A CYBER ATTACK

Alert

Logo de Microsoft

Alert 2026-144 Code execution vulnerability in Microsoft Paint

Affected product(s): 

ProductAffected versions
Microsoft Paint (Microsoft Store app)From 11.0.0.0 up to but not including 11.2609.401.0

The CVE record indicates that versions up to but not including 11.2605.91.0 are affected; the operational threshold confirmed in the vendor advisory is 11.2609.401.0 or later.

Description

A high-severity vulnerability (CVSSv3.1 8.1 – HIGH) has been disclosed for Microsoft Paint, the image editor included by default in Windows. The vulnerability has been assigned the identifier CVE-2026-83844, is an out-of-bounds read (CWE-125), and is categorized by the vendor as Remote Code Execution, with Important severity. The CVSS vector published by the vendor is exactly CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

According to the advisory, an unauthenticated attacker could send a specially crafted packet over the network to “an affected service” and execute code without user interaction. The vendor does not identify that service, port, or protocol, and does not confirm that merely opening an image is sufficient. It is not stated here that Paint exposes a network service; the FAQ appears to be the typical text for a network service applied to an image editor, leaving an unexplained inconsistency in the advisory.

The interpretation consistent with an image editor—and with an out-of-bounds read—is that a user opens a specially crafted image with Paint. According to the CVSS guidance, flaws that require receiving or opening malicious content are scored as Local (AV:L) and with user interaction (UI:R), rather than Network or UI:None, regardless of whether the file arrived by email, a link, or a removable device. In addition, Paint is not Windows’ default image viewer: double-clicking an image is not enough; someone must explicitly choose “Open with Paint” or open it from the app itself. A possible explanation for AV:N is the ease of sending an image and getting someone to open it; even so, by the CVSS definition, this is still local exploitation. The official vector is reproduced so that each reader can assess the vendor’s rationale.

The vendor reports a high attack complexity (AC:H): successful exploitation requires in-depth knowledge of the system and is not guaranteed. As of Nov 6, 2026, there is no known exploitation or prior public disclosure; the vendor rates it as Exploitation Less Likely. It does not appear in catalogs of known exploited vulnerabilities. EPSS is 0.73% (54.5th percentile, as of Nov 5, 2026).

Mitigation

The patch is not delivered through Windows Update: it is provided when Microsoft Store updates Paint. An up-to-date Windows system does not mean that Paint is up to date. It is recommended to:

  • Check the version installed by each user and the provisioned package (new profiles).
  • In managed environments, enforce updates to Microsoft Store apps.
  • Where Paint is not needed, consider uninstalling it for all users and removing the provisioned package so that new profiles do not restore it (test first).
  • In the meantime, do not open image files from untrusted sources with Paint.

Verification (PowerShell with elevated privileges):

  • Get-AppxPackage -AllUsers -Name Microsoft.Paint | Select-Object Version, PackageUserInformation
  • Get-AppxProvisionedPackage -Online | Where-Object DisplayName -eq 'Microsoft.Paint' | Select-Object Version

Any version earlier than 11.2609.401.0 is considered pending an update.

Solution

The solution is to update Microsoft Paint to build 11.2609.401.0 or later from Microsoft Store and verify that the update reached each user profile and the provisioned package. The CVE record references the threshold 11.2605.91.0; the fixed build published in the vendor advisory—and the operational figure to use—is 11.2609.401.0.

For information about how to update, visit the following link:

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83844

Additional information: