Quick Takeaways
- Windows Paint had a high-severity RCE flaw (CVE-2026-83844), caused by an out-of-bounds read.
- Exploitation requires local access and user interaction—for example, persuading someone to open a crafted file; no attacks have been reported.
- The fix is available: update Paint to version 11.2609.401.0 through the Microsoft Store.
- Microsoft’s guidance and rollout were initially unclear: the advisory’s attack description and severity changed, and the correct update reached the Store on Nov. 6.
Paint Update Closes a High-Severity Security Flaw
Microsoft has fixed a security flaw in Windows Paint that could let an attacker run code on a computer. The bug, CVE-2026-83844, involves Paint reading data outside its intended limits. Microsoft rates it 7.0 out of 10 for severity.
However, an attacker needs local access and must persuade someone to open a specially crafted file. Microsoft says it has seen no reports of exploitation. The company recommends updating Paint to version 11.2609.401.0. Users can check the version under Paint > Settings > About, or look for updates in the Microsoft Store. Automatic Store updates have already installed the fix for customers who enabled them.
Changing Guidance Created Weeks of Confusion
The fix took an unusual path. Microsoft disclosed the flaw on Oct. 13, but the version listed as corrected did not appear in the Store at first. By Nov. 4, the advisory named version 11.2609.401.0, while the Store still offered an older release. The correct version arrived on Nov. 6.
Microsoft also changed its description of the threat. Early guidance referred to an attack over a network; later, the company described a local attack that could begin when someone opens a harmful file. That explanation better fits an image editor, although Microsoft has not shared what specifically triggers the flaw.
The episode shows why familiar tools deserve security attention, too. Paint may seem simple, but people use it to handle everyday images and files. Therefore, keeping even basic apps updated remains a practical step for protecting a computer.
Continue Your Tech Journey
Explore the future of technology with our detailed insights on Artificial Intelligence.
Discover archived knowledge and digital history on the Internet Archive.
CyberRisk-V1
