Microsoft has disclosed CVE-2026-83844, an out-of-bounds read in the Microsoft Store version of Paint that could allow remote code execution. Microsoft rates the vulnerability Important, while its CVSS score of 8.1 places it in the high-severity range. Its assessment indicates a network-based attack requiring no privileges or user interaction, although successful exploitation has high complexity.
Because Paint is serviced through the Microsoft Store, a fully patched Windows operating system does not necessarily prove that the application itself has received the security update. Organisations should verify the installed Paint version across user profiles and provisioned packages, using build 11.2609.401.0 or later as the practical target.
What Is CVE-2026-83844?
According to Microsoft’s security advisory, CVE-2026-83844 is a CWE-125 out-of-bounds read in Microsoft Paint. This weakness occurs when software reads beyond the memory region it was intended to access. Microsoft classifies the resulting impact as remote code execution over a network.
The CVSS vector records a network attack vector, no privileges required and no user interaction. However, attack complexity is high. Microsoft says successful exploitation depends on a combination of environmental, configuration and security conditions and requires detailed knowledge of the target system.
Microsoft has not published the complete attack path. Its advisory says an unauthenticated attacker could send a specially crafted packet to an affected network service, but it does not identify the service, port or protocol. It also does not confirm that opening a crafted image alone is sufficient to trigger the flaw.
The flaw has been informally dubbedPaint2Shell. The nickname is not an official Microsoft name, and no public exploit or shell technique has been demonstrated. Microsoft currently lists the vulnerability as not publicly disclosed, not exploited and less likely to be exploited. The immediate task for defenders is therefore to confirm that the Store-delivered Paint update has reached managed endpoints.
Which Microsoft Paint Versions Need Attention?
- Affected range in the CVE record: Microsoft Paint 11.0.0.0 through versions below 11.2605.91.0.
- Current Security Update Guide build: 11.2609.401.0.
- Practical verification target: Confirm 11.2609.401.0 or later on each endpoint.
The two version values are not necessarily direct contradictions. The CVE record defines the affected-version boundary, while Microsoft’s update table identifies the build currently associated with the security release. Still, tools and teams may read different feeds. Checking the installed app directly is the clearest way to avoid an incorrect assumption about patch status.
Why Does Microsoft Store Delivery Matter?
Paint is serviced as a Microsoft Store app. A fully patched Windows operating system does not by itself prove that the installed Paint package has received the security update. This creates a separate visibility problem for organisations that block Store access, manage Store applications through MDM or maintain provisioned packages for new user profiles.
Defenders should check both installed packages and the provisioned image. Otherwise, an updated package for one user could coexist with an older copy assigned to another user or staged for future profiles.
Is CVE-2026-83844 Being Exploited?
As of November 6, 2026, Microsoft reports no known exploitation and no public disclosure. Its exploitability assessment is Exploitation Less Likely, and exploit-code maturity is listed as unproven. These signals reduce the immediate likelihood of widespread attacks, but they do not remove the need to apply the official fix.
Because Microsoft has not published the vulnerable processing path, there are no reliable CVE-specific network signatures or indicators of compromise. Detection should therefore focus on unexpected behaviour associated with Paint while teams complete version verification.
What Should Defenders Do Now?
- Update Paint: Use the Microsoft Store or the organisation’s Store-app management process and target build 11.2609.401.0 or later.
- Verify every user context: Check installed packages for all users instead of relying only on the current account or an endpoint scanner.
- Review provisioned packages: Confirm that new profiles will not receive an older Paint build from the Windows image.
- Monitor behaviour: Investigate Paint spawning command shells or scripts, making unusual network connections, writing executables or crashing unexpectedly.
How Can Teams Verify Paint Builds?
Installed packages:
Get-AppxPackage -AllUsers -Name Microsoft.Paint | Select-Object Name, VersionProvisioned package:
Get-AppxProvisionedPackage -Online | Where-Object DisplayName -eq 'Microsoft.Paint' | Select-Object DisplayName, VersionThese checks confirm package versions, not compromise. Unexpected process or network activity should be investigated as behavioural evidence rather than treated as a CVE-specific indicator.
Frequently Asked Questions
Does Exploitation Require Opening an Image?
Microsoft’s advisory does not confirm that opening an image triggers the vulnerability. It describes a crafted network packet sent to an affected service and records no user interaction, but the affected service and complete exploitation path remain undisclosed.
Which Paint Version Should Organisations Verify?
Microsoft’s current Security Update Guide lists build 11.2609.401.0 for the security update. Organisations should verify that build or a later version rather than relying only on an ‘up to date’ status message.
Does Windows Update Fix the Paint Vulnerability?
Paint is updated through the Microsoft Store app channel. Windows cumulative-update compliance should therefore be checked separately from the installed Paint package version.
What Is CVE-2026-83844’s Main Takeaway?
CVE-2026-83844 combines a high potential impact with high attack complexity and no known exploitation. The most useful response is not speculation about an unconfirmed image-file trigger. It is confirming that every managed copy of Paint, including provisioned packages, has reached the build Microsoft currently associates with the fix.
Source: SOCRadar · 2026-11-06