Loading vulnerability…
Unauthenticated Remote Code Execution in Windows Paint
CVE-2026-83844 is an out-of-bounds read vulnerability in Microsoft Windows Paint that can allow an unauthenticated attacker to execute code remotely by sending a specially crafted network packet to an affected service, without user interaction. The vulnerable function, affected service, network port, and complete attack chain have not been identified publicly. Microsoft disclosed the vulnerability on October 13, 2026, rated it Important with a CVSS v3.1 base score of 8.1, and assessed exploitation as Less Likely. No known exploitation was reported at disclosure.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can result in remote code execution with high impacts to confidentiality, integrity, and availability. The execution privilege level is not specified. Exploitation has high attack complexity and depends on the target environment, configuration, and security controls.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround or interim compensating control is documented.
Patch, then assume compromise.
Apply Microsoft's security update for Windows Paint through the Microsoft Store and verify the installed application version on every affected device. Microsoft's documented corrected build is 11.2609.401.0 or later, whereas the NIST record lists affected versions from 11.0.0.0 up to, but excluding, 11.2605.91.0. Follow Microsoft's current vulnerability-specific guidance to resolve this discrepancy rather than relying solely on the lower version threshold. Update availability has reportedly varied, so confirm that the corrected build was actually installed. Windows operating-system updates alone do not necessarily update the separately maintained Paint application.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
108 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.