Skip to main content
cve.nowby Sazabi
← Early warnings
SZB-0f0221e743Early warningVulnerabilityConfirmed

Microsoft Paint RCE flaw CVE-2026-83844 fixed via Store update, not Windows Update

A fix for CVE-2026-83844, an out-of-bounds read flaw that could let a network attacker run code in Windows Paint, is available only through a Microsoft Store update, according to The Hacker News.

Written by a model from the sources below. Verify against them.

Sources6Confirmed
Kind
Vulnerability
Vendor
Microsoft
Product
Windows Paint
Status
Confirmed
First seen
Confirmed

Summary

A fix for CVE-2026-83844, an out-of-bounds read flaw that could let a network attacker run code in Windows Paint, is available only through a Microsoft Store update, according to The Hacker News. The fixed build is 11.2609.401.0, which The Hacker News found to be the newest Paint build in all ten countries it checked.

What to do

  • Update Paint through the Microsoft Store to build 11.2609.401.0 or later.

  • Do not rely on Windows Update to deliver this Paint fix.

  • Check the installed Paint version in the Microsoft Store update list.

Timeline

  1. Made public by Mastodon
  2. First seen by cve.now
  3. Confirmed as CVE-2026-838441 day
  4. Record last updated

Evidence 6

  1. Social
    Mastodon
    “Microsoft patched Windows Paint RCE vulnerability CVE-2026-83844 with an 8.1 CVSS score.”
  2. Social
    r/cybersecurity
    “Microsoft Paint Vulnerability Could Enable Remote Code Execution Over a Network Without Authentication (CVE-2026-83844)”
  3. Social
    r/sysadmin
    “CVE-2026-83844 - Windows Paint Remote Code Execution Vulnerability”
  4. Press
    The Hacker News
    “A fix for CVE-2026-83844, a remote code execution flaw in Windows Paint, is now in the Microsoft Store.”
  5. Social
    Mastodon
    “Microsoft Paint CVE-2026-83844 (RCE) needs a Microsoft Store app update, not just Windows cumulative updates.”
  6. Social
    Mastodon
    “Authorization bypass through user-controlled key in Entra Device Registration allows an unauthorized attacker to elevate privileges over a network.”

Corrections

None so far.

Something wrong on this page? Report an error. Every fix is listed here.

Questions about SZB-0f0221e743

Has Microsoft confirmed it?

Mastodon, r/cybersecurity and r/sysadmin report a possible compromise. None of the sources says it happened.Source: Mastodon, r/cybersecurity, r/sysadmin, The Hacker News, Mastodon, Mastodon

What should Microsoft users do?

Update Paint through the Microsoft Store to build 11.2609.401.0 or later. Do not rely on Windows Update to deliver this Paint fix. Check the installed Paint version in the Microsoft Store update list.

Does it have a CVE?

Yes. It is tracked as CVE-2026-83844.Source: CVE-2026-83844

Sources

Tracked as