Cve lists CVE-2026-83844 as a Windows Paint remote code execution vulnerability that lets an unauthorized attacker execute code over a network, published by Microsoft Corporation as CNA on 2026-10-13 and updated 2026-10-31.
The detail most coverage skips is the vector string itself: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H with RL:O and RC:C.
That string is the mechanism in miniature. AV:N means the attacker does not need local access. PR:N and UI:N mean no privileges or user click are required in the metric. AC:H is the brake: high attack complexity, which signals preconditions that keep this from being a fire-and-forget worm. C:H/I:H/A:H is total impact if those conditions are met.
Paint should be a local surface. It parses image files. An out-of-bounds read, CWE-125, is a classic decoder bug: the parser reads past an allocated buffer while handling a crafted file, and that memory disclosure can be turned into code execution when combined with follow-on primitives. The CVE record describes exactly that, an out-of-bounds read that leads to remote code execution.
Affected product is Microsoft Paint from 11.0.0.0 before 11.2605.91.0, according to the CVE record. The fix line is explicit. RL:O indicates an official remediation exists, and RC:C indicates confirmed report confidence. In practice that points to updating Paint at or beyond 11.2605.91.0 as listed by Microsoft via msrc.microsoft.com.
Neowin framed the same issue as exposing Windows 11 PCs to hacking over the internet via Paint, which narrows the generic network vector to the current Windows 11 Paint deployment.
This is where workflow matters. Paint now opens by default from web downloads, clipboard paste, and context menu edits. Users drag in PNG, BMP, or JPEG from untrusted sources, and many help desks still use Paint to crop screenshots before forwarding them. If the decode happens on open, the network step is file delivery, not direct socket access.
Skepticism is warranted on reach. AC:H plus E:U, exploit maturity unproven, suggests no public weaponization was documented in the record as of publication. That does not remove risk, it defines it: an attacker still needs a reliable crafted image and a path to get Paint to parse it.
Patch gap is the practical consequence. Any host still on Paint builds before 11.2605.91.0 remains in the affected range, and the official fix is already published.
