Microsoft’s Windows Paint Has Been Vulnerable to Remote Code Execution – Here’s What You Need to Know
A high-severity vulnerability in Microsoft Paint has been patched after weeks of confusion over how to fix it. The remote code execution (RCE) bug, known as CVE-2026-83844, allowed attackers to execute malicious code on a victim’s computer with just some user interaction and local access. While the patch is now available, the initial advisory left many defenders scratching their heads.
The vulnerability was first disclosed by Microsoft last month, but it wasn’t until recently that the company clarified how to fix it. The issue lies in an “out-of-bounds read” in Windows Paint, which allows attackers to execute code locally. However, acquiring RCE requires local access and some user interaction, which might explain why the attack is considered high severity rather than critical.
According to Microsoft, no exploitation reports have been observed to date, making it less likely that attackers will take advantage of this vulnerability. Nevertheless, users are advised to update their Windows Paint version to 11.2609.401.0 as soon as possible. The fixed patch is available now, and customers can check for updates by going to Paint > Settings > About.
The timeline surrounding the patch has been unusual, with some confusion over which version of the fix was actually live. Brian Vitko, founder of RFF, noted that Microsoft first disclosed the bug on October 13 but didn’t indicate that a fix was available even as late as October 30. By November 4, the correct fixed version was listed in the security advisory, but it wasn’t until November 6 that the correct update was added to the store.
The original version of the advisory’s FAQ suggested that the attack could be exploited by sending a specially crafted packet to an affected service over the network. However, this has since been revised to explain how an attacker might use social engineering tactics to convince a victim to download and open a malicious file from a website, leading to a local attack.
While Microsoft hasn’t provided further details on the actual trigger for the vulnerability, it’s clear that this issue was more complex than initially reported. As Vitko noted, “Paint isn’t something that listens on the network,” which might explain why the initial CVSS score was higher and the FAQ language seemed off-target.
In any case, users are advised to prioritize updating their Windows Paint version to ensure they’re protected from potential attacks. With the patch now available, it’s essential to take this vulnerability seriously and apply the fix as soon as possible.
As a practical takeaway, it’s crucial for users to stay informed about security updates and patches, even if the process seems unclear or confusing at first. By regularly checking for updates and keeping software up-to-date, you can significantly reduce your risk of falling victim to vulnerabilities like this one.
Source: Dark Reading — 2026-11-09