Microsoft Paint remote code execution flaw CVE-2026-83844 rated CVSS 8.1
A CVE record, CVE-2026-83844, titled "Windows Paint Remote Code Execution Vulnerability", describes a flaw in Microsoft Paint. The record was assigned by Microsoft (MSRC), published on 2026-10-13 and last updated on 2026-10-31.
The description is a single sentence: an out-of-bounds read in Windows Paint lets an unauthorized attacker execute code over a network. The weakness is classified as CWE-125 (Out-of-bounds Read).
The affected product is Microsoft Paint, versions 11.0.0.0 up to but not including 11.2605.91.0. Version 11.2605.91.0 is therefore the first one outside the affected range.
The record gives a CVSS 3.1 base score of 8.1 (High), with the vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. In plain terms, the attack runs over the network, its complexity is rated high, it needs no privileges and no user interaction, and the impact on confidentiality, integrity and availability is rated high on each.
A CISA entry (ADP) in the record adds an SSVC assessment: Exploitation: none; Automatable: no; Technical Impact: total. The record also points to the MSRC update guide entry for CVE-2026-83844.
The cve.org page itself loads through JavaScript, so these details come from the underlying CVE API record rather than from rendered page text.
Key facts
- CVE-2026-83844 is a remote code execution vulnerability in Windows Paint, assigned by Microsoft (MSRC), published 2026-10-13 and last updated 2026-10-31.
- The cause is an out-of-bounds read (CWE-125) that lets an unauthorized attacker execute code over a network.
- Microsoft Paint versions 11.0.0.0 up to but not including 11.2605.91.0 are affected.
- The CVSS 3.1 base score is 8.1 (High), vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
- CISA's SSVC entry lists Exploitation: none, Automatable: no, Technical Impact: total.
Why it matters
Paint is a small, long-standing Windows app, and this record shows that even a simple app can carry a network-reachable code execution bug. The record rates it 8.1 (High) on CVSS 3.1, with high impact on confidentiality, integrity and availability. The CISA assessment pulls the other way on urgency: exploitation is listed as none and automatable as no, though technical impact is total.
Who it affects
Anyone running Microsoft Paint in versions 11.0.0.0 up to but not including 11.2605.91.0. The record names no other product.
How to use it
Check which version of Microsoft Paint is installed. Anything in the range 11.0.0.0 up to but not including 11.2605.91.0 is listed as affected, and 11.2605.91.0 is the first version outside it. The record points to the MSRC update guide entry for CVE-2026-83844 for the vendor's own guidance.
How solid is it
The record comes from Microsoft (MSRC) as assigner, with a CISA (ADP) entry alongside it, so the core facts are the vendor's own. The cve.org page is a JavaScript shell, so the details above were read from a summarised copy of the CVE API record rather than the page itself. The record does not describe an exploit or proof of concept, and its SSVC entry says exploitation: none.
Risks and caveats
The record is terse. It does not explain what conditions make the attack complexity high (AC:H), names no researcher, and gives no patch release date or fix instructions beyond the fixed-version boundary. Severity and exploitation status can change as a record is updated; this one was last updated on 2026-10-31.
“An out-of-bounds read in Windows Paint lets an unauthorized attacker execute code over a network.”
— CVE-2026-83844 record description