The Vulnerabilities We Deserve: Has Everyone Checked That Nobody Got In Through Paint?

Every few years, somebody discovers that the program we all use to draw a red circle on a screenshot can be a security story. This is one of those years. On October 13, 2026, Patch Tuesday brought CVE-2026-83844: an out-of-bounds read in Windows Paint that, per Microsoft, "allows an unauthorized attacker to execute code over a network".

So: has everyone checked that nobody got into their computer through Paint? Here is what is actually known, what is not, and how to check in two minutes, with only as much sarcasm as the facts support.

What the sources say

• The bug. Out-of-bounds read (CWE-125) in Windows Paint. The CVE record, NVD and Microsoft use the same one-line description. (Microsoft advisory)
• Severity. CVSS 3.1 base score 8.1 (vector AV:N/AC:H/PR:N/UI:N: network, high complexity, no privileges, no user interaction, high impact on all three). Microsoft's temporal score is 7.1 because no exploit code is known and an official fix exists. Microsoft's severity label is Important.
• Exploitation. Microsoft's own assessment: not exploited, not publicly disclosed, "Exploitation Less Likely". CISA's SSVC entry in NVD reads exploitation "none", automatable "no", technical impact "total". We have no KEV entry and found no public exploit.
• Affected. Microsoft Paint, from 11.0.0.0 up to but not including the fixed version.
• Fix. Microsoft's advisory lists the Store app update, fixed build 11.2609.401.0. The CVE record says affected versions are "less than 11.2605.91.0". The two numbers differ, so we recommend aiming for the higher, 11.2609.401.0 or later, which is what Microsoft's product listing names as the fixed build.

The part that doesn't add up (yet)

Microsoft's FAQ describes the attack the way it describes many network bugs: an unauthenticated attacker "sending a specially crafted packet to an affected service over the network", with no user interaction. Paint is an image editor, not a network service, and neither the advisory nor the CVE record explains what in Paint would receive a packet. We do not know. It may be boilerplate wording that fits a scoring template better than the product, or it may describe a path Microsoft has chosen not to detail. Either way, the CVSS 8.1 is Microsoft's published rating and the "high complexity" flag matters: Microsoft says successful exploitation "requires an attacker to have a deep understanding of the system" and "is not guaranteed".

What we will not do is invent an attack story. No technical write-up or proof of concept is public that we could find, and anything we said about how it works would be a guess.

The vulnerabilities we deserve

There is a pattern worth noticing, and it is a more serious point than the Paint joke. We spend our patching attention on firewalls, VPNs, mail servers and the other things that sit in a diagram. Then a Patch Tuesday lands a Remote Code Execution entry in the program people open to crop a picture, and the real question is not "how bad is it" but "do we know where it is installed, and who updates it?"

• Store apps update on their own schedule. Windows Update does not necessarily cover them, so a machine can be fully patched in the usual sense and still run an old Paint.
• Nobody inventories the small stuff. Asset lists have servers and endpoints; they rarely have "Microsoft Paint, version".
• "It's just Paint" is how it gets ignored. The attacker does not care whether you consider an app important.

How to check your own machine

1. Version. In PowerShell: Get-AppxPackage Microsoft.Paint | Select Name, Version. You want 11.2609.401.0 or later. Or open Paint, then Settings, About.
2. Update. Open Microsoft Store, go to Library, choose Get updates. Restart Paint afterwards.
3. Fleets. Managed devices may have the Store restricted or disconnected from updates. Check how Store apps are updated in your environment instead of assuming Windows Update covers them.
4. Unsure what you run? Add Windows and the apps you use to My Stack, and the next CVE that touches them shows up in your feed.

What we don't know

• How the bug is reached in practice, given that Paint is not a network service.
• Why the CVE record and Microsoft's product listing give different fixed versions.
• Whether anyone is working on an exploit. Microsoft says exploitation is less likely; EPSS is low (0.7%). Both can change; check the exploitation radar and trends rather than relying on a snapshot.

Data as of 2026-11-06live record →

Sources: Microsoft Security Update Guide, CVE-2026-83844, NVD entry, CVE record, CISA KEV catalog. Data from the CVE Tools index and Microsoft's advisory API, Nov 6, 2026.