Microsoft Paint flaw rated 8.1/10 has a patch, but rollout varies

Microsoft has fixed a high-severity vulnerability in Paint that could let an attacker run malicious code remotely. The flaw, tracked as CVE-2026-83844, received a severity score of 8.1/10. The National Vulnerability Database describes it as an out-of-bounds read that could allow an unauthorized attacker to execute code over a network.

An attacker could create a specially crafted image that triggers the flaw when opened in Paint. Microsoft has not published technical details, and the source reports no confirmed exploitation in the wild or publicly available exploit code. The vulnerability is not listed in the Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog. Microsoft classified the attack vector as network-based with no privileges required, while rating the attack complexity high.

Paint is now a standalone Microsoft Store app, so its fix does not arrive through the regular Windows Update mechanism. The source says Microsoft included a fix in version 11.2605.91.0, but some users were reportedly still offered vulnerable version 11.2605.81.0. At the time of TechRadar’s check, the Store offered version 11.2609.401.0, with November 5 listed as its latest update. The report says some users found the fix in that version, and suggests Microsoft may be using a staggered rollout.

The article says users can check their installed version with PowerShell using Get-AppxPackage Microsoft.Paint | Select-Object Name, Version. Microsoft’s Security Update Guide is cited as a source for the vulnerability.