A security flaw in Microsoft Paint allows remote code execution. The vulnerability, tracked as CVE-2026-83844, lets an unauthenticated attacker execute code on vulnerable systems without any user interaction. According to Microsoft, sending a specially crafted packet is sufficient.
In its security bulletin of 13 October, Microsoft states that an attacker needs extensive knowledge of the system to succeed. A successful attack also depends on factors such as the environment, the system configuration and the presence of additional security measures. Microsoft says the problem is fixed in Microsoft Paint version 11.2609.401.0.
The patched version should be available through the Microsoft Store, but administrators report on Reddit that they cannot obtain it. People are also complaining on Microsoft’s forum. The version offered by the Store dates from 21 August. Users also say that Paint can no longer be updated through Windows Update and must be updated via the Store.
Neowin reports that administrators should not assume Paint is up to date just because the Microsoft Store says so. You can check the installed version in PowerShell with the command Get-AppxPackage Microsoft.Paint | Select-Object Name, Version. Keep checking the Store for updates, because the update may be rolled out in phases.
Read msrc.microsoft.com article for more information.
