GoKawiilMicrosoft patches high-severity RCE flaw in Windows Paint after month of confusion over fix version
Microsoft has released a fix for CVE-2026-83844, an out-of-bounds read vulnerability in Windows Paint that could let an attacker execute code locally, carrying a CVSS score of 7.0. The patch, version 11.2609.401.0, is distributed through the Microsoft Store, and Microsoft says it has seen no evidence of active exploitation. Researcher Brian Vitko noted the advisory initially listed an incorrect fix version after the bug's October 13 disclosure, with the correct build only confirmed in early November.
GoKawiil's interpretation of the reporting above, not reported fact.
The flaw requires local access and user interaction, which likely explains its high rather than critical severity rating despite enabling remote code execution. The weeks-long discrepancy between the disclosed fix version and the actual patched build could have left defenders checking for the wrong update, potentially delaying remediation even though Microsoft maintains exploitation risk was low throughout.
- CVE-2026-83844 is a high-severity (CVSS 7.0) out-of-bounds read bug in Windows Paint enabling local code execution.
- The fixed version, 11.2609.401.0, is delivered via the Microsoft Store and applied automatically for most users.
- Researchers flagged confusion over which build actually contained the fix for nearly a month after initial disclosure.
Source: darkreading.com — Alexander Culafi, 2026-11-09
Published there as: “Microsoft Fixes RCE Bug in Windows Paint After Weeks of Confusion”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.