CVE-2026-83844: Why Windows Update Can’t Save Your Paint App

Paint Gets a CVE, and Patch Tuesday Can’t Fix It

Microsoft Paint is the app nobody puts on a risk register, and it now has a remote code execution flaw rated 8.1. A patch exists. The hard part is getting it onto your fleet, because Windows Update won’t deliver it.

What Happened?

In its October 13 security release, Microsoft disclosed CVE-2026-83844, an out-of-bounds read (CWE-125) in the Windows 11 Paint app. Microsoft says an unauthenticated attacker could run code over a network. It hasn’t said which file format, service, or port is involved.

The Fixed Build Changed After October

Then the fix changed. Microsoft first pointed to build 11.2605.91.0, which never showed up in the Store. In early November, its guidance switched to 11.2609.401.0, with no revision note. Plenty of admins who “updated” in October ended up on 11.2605.81.0 and had no idea. Classic Paint on Windows 10 isn’t listed.

What’s the Impact?

Any code an attacker runs gets the same rights as the person using Paint. Paint updates through the Microsoft Store, so the October cumulative update never touched it. The machines most likely to be left exposed are locked-down fleets, kiosks, and shared PCs, because Store updates install separately for each user profile.

By the Numbers

• CVSS 8.1 (High), with high attack complexity
• EPSS of 0.73% as of early November
• Not on the CISA KEV list
• No known exploitation, and Microsoft rates it “Exploitation Less Likely”
• Affected: Paint 11.0.0.0 up to 11.2609.401.0

How to Avoid This

Check Your Paint Build

Close the Gap on Every Device

• Treat any Paint build below 11.2609.401.0 as vulnerable, whatever the CVE record says
• Check every profile on each PC, not just the one you’re signed into
• If policy blocks Store updates, push the update through Intune or winget
• Remove Paint from kiosks, jump hosts, and servers that never needed it
• Keep Mark of the Web and attachment scanning turned on for image files

Patching is only half the job here. This is the gap between exposure management and vulnerability management: a pushed update and a fixed device are not the same thing.

IOCs: None Published Yet

Nobody has published an exploit, a proof of concept, or any indicator specific to this CVE, so there’s nothing to block yet. Hunt for behavior instead.

Behavioral Red Flags to Hunt For

• Paint launching cmd, PowerShell, mshta, or rundll32
• Paint connecting out to hosts that aren’t Microsoft’s
• Paint crashing repeatedly with access violation 0xc0000005
• Paint writing executables or touching Run keys

Your Dashboard Says Patched. Your Fleet Disagrees.

Paint shows that a fix can exist and still miss half your machines. Secure.com brings governed defense, powered by offense, so you see the exposure you really have, not the one your dashboard assumes.

• Live inventory of apps and package versions on every device and user profile, closing the asset visibility gaps that hide builds like this one
• Offensive validation that checks whether a fix landed, not just whether it was pushed, through continuous red teaming
• AI agents that catch Paint spawning a shell and triage the alert in minutes, the way an AI SOC should
• Remediation playbooks with human approval built in, so nothing runs ungoverned
• No more chasing build numbers through spreadsheets at midnight

Frequently Asked Questions

The Bottom Line

The odds of exploitation are low today. That changes the day a proof of concept drops. Check your Paint builds this week, while this is still housekeeping and not an incident.