Microsoft Paint: RCE flaw

Microsoft Paint

A remote code execution flaw in Windows Paint can be exploited through an out-of-bounds read.

Do this now

Upgrade Microsoft Paint to 11.2605.91.0.

Fix it

Upgrade to Microsoft Paint 11.2605.91.0

First seen: 6 Nov 2026
Last update: 6 Nov 2026, 13:18 UTC
Fixed in: 11.2605.91.0
Identifiers: CVE-2026-83844
CVSS: 8.1
Source: news

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Microsoft Paint: RCE flaw
Severity: high. Patch status: patched.
Affected: Microsoft Paint
Fixed in: 11.2605.91.0
Ids: CVE-2026-83844

A remote code execution flaw in Windows Paint can be exploited through an out-of-bounds read.

## Steps
1. Search the repo, its CI and infra config for Microsoft Paint. If present, report the version in use and whether it's affected.
2. Fix by release line: Microsoft Paint: 11.2605.91.0.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| Microsoft Paint | fixed | 11.2605.91.0 | — |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-83844") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://thehackernews.com/2026/11/microsoft-paint-rce-fix-now-available.html
https://pwned.coffee/i/microsoft-paint-rce-flaw-cve-2026-83844

Receipt

Exploitation: No known exploitation
Fix by release line: Product Affected Fixed in Source
Microsoft Paint before 11.2605.91.0 11.2605.91.0 CVE record (CNA) checked 6 Nov
Score: CVSS 8.1 (high). CVSS 3.1 8.1 (CNA microsoft) for CVE-2026-83844
Last checked: 6 Nov 2026, 13:18 UTC

Product	Affected	Fixed in	Source
Microsoft Paint	before 11.2605.91.0	11.2605.91.0	CVE record (CNA) checked 6 Nov

Sources: KEV – CVE record ✓ Vendor ✓

Sources

feeds.feedburner.com: Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It

Follow on X

Totalone hot coffee