Microsoft's CVE record for CVE-2026-83844 (Windows Paint Remote Code Execution Vulnerability), last updated 7 November 2026 at 23:26 UTC (07:26 AWST 8 November), describes an out-of-bounds read (CWE-125) in Windows Paint that allows an unauthorized attacker to execute code locally. Microsoft's CNA metric is CVSS 3.1 baseScore 7 (baseSeverity HIGH) with vector CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C, and the record lists Microsoft Paint affected from 11.0.0.0 to below 11.2609.401.0.

The MSRC HTML update-guide page remains a JS app shell. Microsoft's Security Update Guide entry, previously read via the MSRC SUG API, rated it Important, impact Remote Code Execution, publicly disclosed No, exploited No, and Exploitation Less Likely for the latest software release; that entry's release date is 13 October 2026 (2026-Oct), and revision 2 dated 6 November 2026 08:00 PST states that to comprehensively address the vulnerability Microsoft released a new version of Paint with build 11.2609.401.0 and recommends installing that version or ensuring it was automatically updated. (source: Microsoft CVE record for CVE-2026-83844)

Correction (08 Nov 2026): Microsoft's CVE record, last updated 7 November 2026 at 23:26 UTC (07:26 AWST 8 November), now scores CVE-2026-83844 as CVSS 3.1 base 7.0 (HIGH) with vector CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C, and describes an out-of-bounds read that allows an unauthorized attacker to execute code locally.

The card had stated Microsoft's earlier MSRC figures of CVSS 3.1 base 8.1 (temporal 7.1) and a network attack with no user interaction (AV:N/UI:N) (source: Microsoft CVE record)

UPDATE (08 Nov 2026): The Microsoft CVE record now lists Paint as affected from 11.0.0.0 to below 11.2609.401.0, matching the fixed build Microsoft named in revision 2. (source: Microsoft CVE record)

Correction (09 Nov 2026): removed The Hacker News as a source and the Store-delivery details only it gave. (source: Microsoft CVE record)