GoKawiilMicrosoft patches high-severity RCE flaw in Windows Paint after month of confusion over fix version
Microsoft has released a fix for CVE-2026-83844, an out-of-bounds read vulnerability in Windows Paint that could let an attacker execute code locally, carrying a CVSS score of 7.0. The patch, version 11.2609.401.0, is distributed through the Microsoft Store, and Microsoft says it has seen no evidence of active exploitation. Researcher Brian Vitko noted the advisory initially listed an incorrect fix version after the bug's October 13 disclosure, with the correct build only confirmed in early November.