Microsoft has announced a vulnerability in Windows Paint that could let unauthenticated attackers execute malicious code remotely without any user interaction. This vulnerability is tracked as CVE-2026-83844 and was disclosed on October 13, 2026.
It carries an “Important” severity rating from Microsoft, and its CVSS 3.1 base score is 8.1, indicating potentially serious consequences, despite the high complexity involved in successfully exploiting it.
According to Microsoft’s security advisory, the vulnerability originates from an out-of-bounds read, classified as CWE-125. This memory-safety weakness occurs when software reads data before the start of an intended buffer or beyond its end. Such errors can expose sensitive memory, crash applications, or help attackers bypass protections when combined with other exploitation techniques.
Microsoft Paint Vulnerability
Microsoft states that an attacker could exploit the vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could execute code on the target system without authentication or user participation.
However, the advisory does not identify the affected service, network port, or detailed execution chain, leaving important implementation details undisclosed.
The vulnerability’s CVSS vector specifies network accessibility, high attack complexity, no required privileges, and no user interaction. Microsoft explains that exploitation requires deep system knowledge and depends on environmental conditions, configuration, and additional security measures. Confidentiality, integrity, and availability impacts are all rated high, while the security scope remains unchanged.
The issue reinforces concerns highlighted by earlier Windows graphics vulnerabilities, although those flaws involve different components and attack mechanisms. Administrators should not assume that an image-processing vulnerability necessarily requires someone to open a malicious attachment: Microsoft explicitly describes this Paint issue as requiring no user interaction.
Microsoft’s current advisory lists Paint build 11.2609.401.0 as the security update. Administrators should compare installed application versions against that vendor-listed build rather than relying solely on operating-system patch status. Recent reporting describes inconsistent update availability through Microsoft Store, making direct version verification particularly important for enterprise remediation.
Security teams incorporating this fix into their October security-update reviews should prioritize identifying outdated Paint installations and deploying the official update. Microsoft assigns a temporal score of 7.1, with exploit maturity marked “Unproven,” remediation marked “Official Fix,” and report confidence marked “Confirmed.”
At original publication, Microsoft reported no exploitation and assessed exploitation as less likely; that historical assessment should not be interpreted as proof that future attacks cannot occur against remaining vulnerable installations.
Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.
