CVE-2026-83844
7.0CVSS base score · high (NVD)
0.4%Chance of exploitation in the next 30 days (FIRST EPSS)
Not in KEVNo confirmed exploitation in CISA's catalog yet
What is it?
Out-of-bounds read in Windows Paint allows an unauthorized attacker to execute code locally.
Official description from NVD.
What happened
Microsoft released a fix for CVE-2026-83844, a remote code execution flaw in Windows Paint, through the Microsoft Store only—not via Windows Update. The vulnerability is an out-of-bounds read enabling network-based code execution. Users must manually update Paint from the Store to receive protection. The fixed build is 11.2609.401.0.
From the Intel60 brief of Nov 6, 2026. AI-written summary: check the sources before acting.
Intel60 briefs
- HighWindows Paint RCE fix available via Microsoft StoreNov 6, 2026