CVE-2026-83844: Windows Paint Remote Code Execution Vulnerability

While it might seem surprising to see a classic graphics utility associated with network-based remote code execution, the technical metrics in Microsoft's advisory make it clear why administrators should ensure their application packages are current.

Technical Overview and CVSS Breakdown​

To help security teams prioritize patching cycles, Microsoft's advisory provides a complete telemetry and scoring breakdown for CVE-2026-83844:

• CVE Identifier: CVE-2026-83844
• Title: Windows Paint Remote Code Execution Vulnerability
• Severity: Important
• CVSS Base Score: 8.1
• CVSS Temporal Score: 7.1
• CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
• Weakness Classification: CWE-125 (Out-of-bounds read)
• Publicly disclosed: No
• Exploited: No
• Exploitation Assessment: Exploitation Less Likely
• Customer action required: Yes

Decoding the Vector and CWE-125​

The underlying flaw is categorized under CWE-125, which denotes an out-of-bounds read condition. In general software engineering terms, an out-of-bounds read occurs when a program reads data past the end, or before the beginning, of an intended memory buffer. While out-of-bounds reads are frequently associated with information disclosure or application crashes, Microsoft's official advisory explicitly notes that in the context of CVE-2026-83844, the out-of-bounds read in Windows Paint allows an unauthorized attacker to execute code over a network.

Looking closely at the CVSS v3.1 vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C), several key operational factors stand out:

1. Attack Vector (AV:N), Privileges Required (PR:N), and User Interaction (UI:N): The vector indicates a network-bound attack surface requiring neither prior authentication nor interactive steps from the local user. In its official advisory FAQ explaining how an attacker could exploit this vulnerability, Microsoft states that an unauthenticated attacker could exploit it by sending a specially crafted packet to an affected service over the network, and that successful exploitation could allow the attacker to execute code on the target system with no authentication or user interaction required.
2. Attack Complexity (AC:H): Despite the zero-click, unauthenticated nature of the vector, the attack complexity is rated High (AC:H), which keeps the overall severity at Important rather than Critical. Microsoft's advisory directly addresses what AC:H means for this vulnerability: successful exploitation requires an attacker to have a deep understanding of the system, and successful exploitation is not guaranteed and depends on a combination of factors that might include the environment, system configuration, and the presence of additional security measures.
3. Impact Metrics (S:U/C:H/I:H/A:H): Although the scope remains unchanged (S:U), a successful exploit poses a High impact to confidentiality (C:H), integrity (I:H), and availability (A:H).
4. Temporal Metrics (E:U/RL:O/RC:C): The temporal score drops from 8.1 to 7.1 because exploit code maturity is unproven (E:U), an official fix is available (RL:O), and report confidence is confirmed (RC:C).

Threat Context​

For defenders assessing immediate risk, Microsoft's threat intelligence telemetry offers reassuring news. At the time of publication, the vulnerability status is marked as Publicly disclosed: No and Exploited: No. Furthermore, Microsoft has assigned an assessment of Exploitation Less Likely, reflecting the high attack complexity hurdles that an adversary must overcome to achieve reliable code execution across varied system configurations and environmental protections.

Summary: Technical Risk Profile​

CVE-2026-83844 is an Important remote code execution vulnerability driven by a CWE-125 out-of-bounds read. Although it can theoretically be triggered over a network via a specially crafted packet sent to an affected service without authentication or user interaction, the high attack complexity (AC:H) and Exploitation Less Likely assessment indicate significant practical barriers to reliable exploitation.

Affected Products and Remediation Guidance​

Resolving CVE-2026-83844 is straightforward and relies on updating the affected inbox application to its patched release. Microsoft has provided exact version and remediation details in the official vulnerability data:

Verifying and Updating Microsoft Paint​

Because Customer action required: Yes is designated for this advisory, system administrators and home users should ensure that Microsoft Paint is updated across their environments:

• Standard Application Updates: Ensure that automatic app updates are enabled so that Microsoft Paint receives fixed build 11.2609.401.0 or later.
• Enterprise Environments: IT administrators who restrict automatic store or inbox application updates via enterprise policies should verify their deployed application inventory and approve or deploy the updated Microsoft Paint package so endpoints reach build 11.2609.401.0 or a subsequent release.
• Version Verification: Users and administrators can verify the installed build of Microsoft Paint on a target machine to confirm it meets or exceeds 11.2609.401.0.

Summary: Action Plan for Administrators​

To remediate CVE-2026-83844, follow Microsoft's exact remediation directive: For Microsoft Paint, update to fixed build 11.2609.401.0 or later. Deploying this build eliminates the CWE-125 out-of-bounds read condition and protects systems against potential network-based code execution attempts.