MS Paint has joined the list of apps that can get your PC owned. Microsoft has published a security advisory for CVE-2026-83844, a remote code execution flaw in Paint that scores 8.1 on the CVSS scale. It is a no-click bug, and the awkward part is that the patched version of Paint may not be the one sitting on your PC right now.
What Is the MS Paint Vulnerability?
CVE-2026-83844 is an out-of-bounds read in Microsoft Paint, a memory bug where the program reads data past the buffer it was supposed to stay inside. Microsoft’s own assessment lists these details:
- CVSS score: 8.1 (High severity)
- Impact: remote code execution
- User interaction: none needed, which makes this a “no-click” bug
- Attack vector: network, with no privileges required
- Attack complexity: high, meaning exploitation depends on conditions that are not trivial to arrange
Microsoft published the advisory on October 13, 2026, as part of its October update cycle, which fixed 1,411 flaws in total, including three zero-days, according to BleepingComputer. In simple terms, a successful attack could run code on the machine with the same permissions as the logged-in user.
The Patch Confusion: Which Paint Version Is Safe?
This is where the story gets messy. Microsoft’s guidance has changed, and users are still working out what is actually fixed.
- Microsoft’s advisory originally listed Paint version 11.2605.91.0 as the fixed release.
- Administrators reported the Microsoft Store kept offering 11.2605.81.0 even after update checks and Store cache resets.
- The advisory now shows 11.2609.401.0 as the corrected build, suggesting the earlier version number was wrong. Microsoft has not confirmed that explanation.
The rollout is inconsistent too. Some admins say the update is hard to get, and one Hacker News commenter reported that Windows Update showed nothing at all until they went to the Microsoft Store directly. Neowin’s report is titled “Paint vulnerability allows RCE, patch is hard to find”, and Windows Report says the same: the fix is hard to find. Practical takeaway: trust the version number, not the “up to date” message.
Why the Attack Path Is Still Unclear
Microsoft’s quoted guidance describes “a specially crafted packet” sent to an affected service over the network, but reports also point to a crafted image triggering the flaw. Neither the exposed service nor the complete attack path is public. The Hacker News thread on the advisory, which drew over 300 points, highlights exactly that gap.
Until Microsoft fills in the details, treat the bug as serious but awkward to exploit. High attack complexity means opportunistic mass exploitation is unlikely, and there are no reports of in-the-wild attacks so far.
How to Check and Update MS Paint
- Check your Paint version. Open Settings, go to Apps, then Installed apps, find Paint, and read the version number. You can also open Paint and check its Settings page.
- Update from the Microsoft Store. Open the Store, go to Library, and hit Get updates. Repeat until no more updates appear.
- Confirm you are on 11.2609.401.0 or newer. If the version stays on 11.2605.81.0, the fix has not reached you yet.
- Remove Paint if you do not use it. Neowin recommends exactly this where Paint is unnecessary. Settings, Apps, Installed apps, Paint, Uninstall does the job.
- Keep Windows 11 current. The wider October update cycle fixed over 1,400 flaws, so install the cumulative update regardless.
- Be careful with unexpected images. Restricting files from unknown sources is not a confirmed fix for this bug, but it reduces general exposure.
Enterprise admins should also note that the fix is delivered through the Microsoft Store, not Windows Update. If your devices block the Store, the Paint update may never arrive, and removing the app becomes the cleaner option.
What Happens If You Get Hit
Remote code execution in Paint means any code the attacker delivers runs with the same rights as the logged-in user. On a home PC that can mean stolen browser tokens and personal files. On a work laptop it can be the first step towards corporate data. The good news is the high attack complexity rating: exploitation depends on conditions that are not easy to arrange at scale, and there are no known in-the-wild attacks so far. The bad news is that no-click bugs are prized once they are understood, so the fix deserves priority anyway.
Paint Has Been in Attackers’ Sights Before
This is not Paint’s first security rodeo. Back in August 2025, security researchers reported that the North Korean group APT37 was weaponising JPEG files that abused mspaint.exe as part of the attack chain. Earlier in 2026, Microsoft added cloud-connected AI features to Paint and Notepad on Windows 11, which means the classic doodle app now talks to more services than it used to.
The bigger lesson is that no Windows component is too small to matter. Every preinstalled app is attack surface, and “just Paint” is exactly the kind of assumption attackers like.
For most home users, the sequence is short: update Paint from the Store, confirm the version number, and move on. For IT teams managing fleets, the version confusion is the real story, so verify the build on managed devices instead of trusting update reports.
What is CVE-2026-83844?
CVE-2026-83844 is a remote code execution vulnerability in Microsoft Paint, caused by an out-of-bounds read. It scores 8.1 on the CVSS scale, requires no user interaction, and was disclosed on October 13, 2026. The fix is Paint version 11.2609.401.0.
How do I update Microsoft Paint?
Open the Microsoft Store, go to Library, and select Get updates. Then verify in Settings, Apps, Installed apps that Paint shows version 11.2609.401.0 or newer. If Windows Update does not offer it, the Store route is the one that works.
Is MS Paint vulnerable on Windows 10?
Microsoft’s advisory covers the current Store-delivered Paint app on Windows 11. Windows 10 uses the older classic Paint, which is a different codebase. Whichever version you run, keeping the operating system patched is the safe move.
Has MS Paint been hacked before?
Paint has been involved in attack chains before. In August 2025, the APT37 group used JPEG files that abused mspaint.exe on Windows systems. CVE-2026-83844 is, however, the first no-click remote code execution advisory specific to the modern Paint app.
