Microsoft Paint has a security hole that Microsoft says could let an attacker run code on a PC over a network, with no click from the owner. The company rated CVE-2026-83844 as High, and a mix-up over which Paint version contains the fix means some people may believe they are patched when they are not.
Microsoft titled the issue “Windows Paint Remote Code Execution Vulnerability” when it published the entry on 13 October as part of its monthly security updates. The underlying fault is an out-of-bounds read: the program looks at memory beyond the area it was given. The score is 8.1 out of 10: the attack works over the network, needs no account and no user action, but Microsoft marks it as hard to pull off.
The Microsoft advisory covers Paint builds from 11.0.0.0 up to, but not including, 11.2605.91.0. That is where the confusion starts. The fixed version was first given as 11.2605.91.0. Yet administrators say the Microsoft Store keeps handing out 11.2605.81.0, however many times they check for updates or reset the cache. The advisory also lists 11.2609.401.0 as the fix, which suggests the first number was wrong, though Microsoft has not confirmed that. A Cybersecurity News write-up of the Reddit and Hacker News discussion adds that one participant did get the update through the Store, and that claims of a regional rollout are unverified.
What is still unclear is how an attacker would reach Paint at all. Microsoft’s wording talks about a crafted network packet sent to an affected service, but it does not name the service or the full attack path. Claims that a booby-trapped image file is the trigger, or that Copilot is involved, are speculation so far.
For now, open Paint’s version number and compare it with the build in the advisory instead of trusting the Store’s “up to date” message. On PCs that do not need Paint, removing the app until Microsoft clears up the fix is one option that has been suggested. Neither the advisory nor the reports say whether the flaw is being exploited.
