Microsoft Paint Zero-Click RCE Flaw Leaves Users Facing Patch Availability Gaps

Microsoft disclosed CVE-2026-83844, an out-of-bounds read vulnerability in Microsoft Paint that could allow an unauthenticated attacker to execute code remotely without user interaction. The flaw carries a reported severity score of 8.1/10 and is rated Important by Microsoft. Exploitation is described as highly complex, and the reports identify no known exploitation in the wild.

Microsoft lists Paint version 11.2609.401.0 or later as patched, but reporters and other users said the Microsoft Store continued to provide older versions. The reason for the discrepancy remains unknown; an incomplete rollout is a possibility, not a confirmed explanation. Windows 11 operating-system updates alone do not necessarily fix the separately maintained application, so organizations should verify installed Paint versions and confirm delivery of the patched release rather than rely solely on automatic-update settings.