CVE-2026-83844: Microsoft Paint RCE Fix Now Available — Why Windows Update Won't Deliver It and What Defenders Must Do Now | Security Arsenal

In late 2026, Microsoft addressed a critical remote code execution vulnerability in Windows Paint — yes, Paint — the unassuming graphics utility bundled with Windows for decades. Tracked as CVE-2026-83844, this is an out-of-bounds read vulnerability that can be exploited by an unauthenticated attacker to achieve code execution over a network. Microsoft rates this flaw as critical, and it has released a fixed build: Paint version 11.2609.401.0.

Here is the catch that makes this vulnerability uniquely dangerous in enterprise environments: the fix is delivered exclusively through the Microsoft Store, not through Windows Update. For organizations that disable the Microsoft Store, restrict consumer app updates, or rely solely on WSUS/SCCM/Intune for patch management, this creates a dangerous blind spot. Your Windows Update compliance dashboards will show green across the board while every workstation remains vulnerable to remote code execution through a default-installed application.

This is not a theoretical concern. Paint is present on virtually every Windows endpoint. An out-of-bounds read that leads to network-based code execution in a ubiquitously installed application is precisely the kind of attack surface that threat actors weaponize rapidly. Defenders need to understand the delivery mechanism gap, verify which endpoints have received the fix, and implement compensating controls immediately.

Technical Analysis

Affected Products and Platforms

CVE-2026-83844 affects Microsoft Paint on Windows, specifically versions prior to 11.2609.401.0. Because Paint ships as a default application on Windows 10 and Windows 11, the attack surface spans virtually the entire Windows installed base — workstations, laptops, VDI instances, and even some server installations where Desktop Experience is enabled.

The vulnerability resides in how Paint parses certain input, resulting in an out-of-bounds read condition. In practical terms, an attacker can craft a malicious file or data stream that, when processed by Paint, reads memory beyond the intended buffer boundary. Microsoft's advisory indicates this can be leveraged for code execution over a network without requiring authentication.

Attack Chain (Defender's Perspective)

From a defender's standpoint, the exploitation chain likely follows this pattern:

Delivery: The attacker delivers a crafted file to the target — via email attachment, malicious download, network share, or a web-based vector. Given the "over a network" characterization, the file itself may be hosted remotely and opened via a network path or URL handler.
User Interaction or Automatic Processing: Paint processes the malformed input. Depending on the specific vector, this could require the user to open a file in Paint, or it could be triggered by thumbnail generation, preview handlers, or file association behaviors that invoke Paint components without explicit user intent.
Out-of-Bounds Read: The malformed data causes Paint's parsing logic to read beyond allocated memory boundaries. In a carefully crafted exploit, this memory disclosure provides the attacker with information needed to bypass ASLR (Address Space Layout Randomization) and chain into code execution.
Code Execution: The attacker achieves arbitrary code execution in the context of the user running Paint. If the user has elevated privileges, the attacker's code inherits those privileges.

Why the Store-Only Delivery Model Matters

This is the critical operational issue. Microsoft has increasingly moved inbox applications like Paint, Notepad, Calculator, and Snipping Tool to Store-delivered update models. This decouples them from the traditional Patch Tuesday/Windows Update cycle. The implications for enterprise security teams are significant:

WSUS/SCCM/Intune patch compliance reports will not flag this vulnerability. Your standard vulnerability management pipeline may show all endpoints as fully patched while Paint remains vulnerable.
Organizations that disable the Microsoft Store (a common Group Policy setting for security or compliance reasons) will never receive this update through automated means.
Vulnerability scanners may or may not detect the vulnerable Paint version, depending on whether they inspect Store-delivered app versions or only traditional Windows components.
The update must be deployed through the Microsoft Store for Business, winget, or manual sideloading — mechanisms that many enterprises either don't use or actively block.

Exploitation Status

As of the publication of the fix (November 2026), there is no confirmed public proof-of-concept exploit, and CVE-2026-83844 has not yet been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. However, given the critical severity rating, the unauthenticated network-based attack vector, and the universal presence of Paint on Windows systems, defenders should treat this as an imminent threat. The gap between patch availability and widespread exploitation has been shrinking consistently — organizations that assume they have weeks to act are making a dangerous bet.

Severity Assessment

Factor	Assessment
Attack Vector	Network (unauthenticated)
User Interaction	Potentially required (file open)
Authentication	None required
Impact	Remote Code Execution
Affected Component	Microsoft Paint (all versions < 11.2609.401.0)
Delivery Mechanism	Microsoft Store ONLY
Windows Update Coverage	None — this is the gap

Detection & Response

The detection strategy for CVE-2026-83844 focuses on two parallel tracks: identifying vulnerable Paint installations across your environment, and detecting exploitation behavior in the event an attacker targets an unpatched endpoint.

Sigma Rules

The following Sigma rules target observable behaviors associated with exploitation of a Paint-based RCE and with identifying the update mechanism itself.

YAML

---
title: Microsoft Paint Spawning Child Processes - Potential CVE-2026-83844 Exploitation
id: a1b2c3d4-5e6f-7890-abcd-ef1234567890
status: experimental
description: Detects Microsoft Paint (mspaint.exe) spawning child processes, which is anomalous behavior and may indicate successful exploitation of CVE-2026-83844 (out-of-bounds read leading to code execution).
references:
  - https://thehackernews.com/2026/11/microsoft-paint-rce-fix-now-available.html
author: Security Arsenal
date: 2026/11/15
tags:
  - attack.execution
  - attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\mspaint.exe'
  filter_known:
    Image|endswith:
      - '\mspaint.exe'
  condition: selection_parent and not filter_known
falsepositives:
  - Rare — mspaint.exe should not spawn child processes in normal operation
  - Accessibility tools or screen readers interacting with Paint
level: high
---
title: Microsoft Paint Network Connection Activity
id: b2c3d4e5-6f78-9012-bcde-f23456789012
status: experimental
description: Detects Microsoft Paint making outbound network connections, which is highly anomalous and may indicate post-exploitation activity following CVE-2026-83844 exploitation.
references:
  - https://thehackernews.com/2026/11/microsoft-paint-rce-fix-now-available.html
author: Security Arsenal
date: 2026/11/15
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\mspaint.exe'
    Initiated: 'true'
falsepositives:
  - Very rare — Paint has no legitimate reason to initiate outbound network connections in typical usage
level: critical
---
title: Microsoft Paint Executed from Unusual Path
id: c3d4e5f6-7890-1234-cdef-345678901234
status: experimental
description: Detects execution of mspaint.exe from a non-standard directory, which may indicate a trojanized or replaced Paint binary used in exploitation of CVE-2026-83844 or as a post-exploitation persistence mechanism.
references:
  - https://thehackernews.com/2026/11/microsoft-paint-rce-fix-now-available.html
author: Security Arsenal
date: 2026/11/15
tags:
  - attack.defense_evasion
  - attack.t1036
logsource:
  category: process_creation
  product: windows
detection:
  selection_name:
    Image|endswith: '\mspaint.exe'
  filter_standard_paths:
    Image|startswith:
      - 'C:\Program Files\WindowsApps\'
      - 'C:\Windows\System32\'
      - 'C:\Windows\SysWOW64\'
  condition: selection_name and not filter_standard_paths
falsepositives:
  - Portable or development builds of Paint-like applications
  - Application compatibility shims in enterprise environments
level: medium

KQL Hunt Queries (Microsoft Sentinel / Defender)

The following KQL queries are designed for Microsoft Sentinel and Microsoft Defender for Endpoint environments to hunt for vulnerable Paint versions and exploitation indicators.

KQL — Microsoft Sentinel / Defender

// Query 1: Identify endpoints running vulnerable Paint versions (pre-11.2609.401.0)
// This queries the DeviceTvmSoftwareInventory table if TVM is enabled
DeviceTvmSoftwareInventory
| where SoftwareName contains "paint" or SoftwareName contains "Microsoft.Paint"
| extend ParsedVersion = parse_version(SoftwareVersion)
| where ParsedVersion < parse_version("11.2609.401.0")
| summarize VulnerableDevices = dcount(DeviceId), DeviceList = make_set(DeviceName, 50) by SoftwareName, SoftwareVersion
| sort by VulnerableDevices desc

// Query 2: Hunt for mspaint.exe spawning child processes (exploitation indicator)
DeviceProcessEvents
| where InitiatingProcessFileName =~ "mspaint.exe"
| where FileName !~ "mspaint.exe"
| project Timestamp, DeviceName, DeviceId, InitiatingProcessFileName, InitiatingProcessCommandLine,
           FileName, ProcessCommandLine, SHA256, AccountName
| sort by Timestamp desc

// Query 3: Hunt for mspaint.exe making network connections (post-exploitation C2 indicator)
DeviceNetworkEvents
| where InitiatingProcessFileName =~ "mspaint.exe"
| project Timestamp, DeviceName, DeviceId, RemoteIP, RemotePort, RemoteUrl,
           InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessSHA256
| sort by Timestamp desc

// Query 4: Hunt for Paint file versions across the environment via file events
DeviceFileEvents
| where FileName =~ "mspaint.exe"
| where FolderPath has "WindowsApps"
| extend PaintVersion = extract(@"Microsoft\.Paint_([0-9\.]+)_", 1, FolderPath)
| where isnotempty(PaintVersion)
| summarize arg_max(Timestamp, *) by DeviceId, PaintVersion
| where parse_version(PaintVersion) < parse_version("11.2609.401.0")
| project DeviceName, DeviceId, PaintVersion, FolderPath, Timestamp
| sort by DeviceName asc

// Query 5: Correlate recent Paint execution with subsequent suspicious activity
let PaintExecution = DeviceProcessEvents
    | where FileName =~ "mspaint.exe"
    | project PaintTime=Timestamp, DeviceId, DeviceName, PaintCmd=ProcessCommandLine;
let SuspiciousAfter = DeviceProcessEvents
    | where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe")
    | project SusTime=Timestamp, DeviceId, SusProcess=FileName, SusCmd=ProcessCommandLine, SusParent=InitiatingProcessFileName;
PaintExecution
| join kind=inner SuspiciousAfter on DeviceId
| where SusTime > PaintTime and SusTime < PaintTime + 5m
| project PaintTime, DeviceName, PaintCmd, SusTime, SusProcess, SusCmd, SusParent
| sort by PaintTime desc

Velociraptor VQL Hunt

For organizations running Velociraptor for endpoint forensics, the following VQL artifact hunts for vulnerable Paint versions and anomalous Paint behavior across the fleet.

VQL — Velociraptor

-- Hunt: Identify vulnerable Microsoft Paint installations and anomalous child processes
-- CVE-2026-83844: Versions prior to 11.2609.401.0 are vulnerable

-- Part 1: Check installed Paint version via WindowsApps directory
LET paint_versions = SELECT
    FullPath,
    basename(path=FullPath) AS PackageFolder,
    parse_string_with_regex(
        string=basename(path=FullPath),
        regex='Microsoft\.Paint_(?P<version>[0-9\.]+)_'
    ).version AS PaintVersion
FROM glob(globs='C:/Program Files/WindowsApps/Microsoft.Paint_*')

SELECT
    PaintVersion,
    PackageFolder,
    FullPath,
    if(condition=PaintVersion < '11.2609.401.0',
       then='VULNERABLE',
       else='PATCHED') AS Status
FROM paint_versions

-- Part 2: Hunt for mspaint.exe with anomalous child processes
SELECT
    Pid,
    Name,
    CommandLine,
    Exe,
    Username,
    CreateTime,
    Ppid
FROM pslist()
WHERE Name =~ 'mspaint'

-- Part 3: Hunt for network connections from mspaint.exe
SELECT
    Pid,
    Name,
    Status,
    LocalAddr,
    LocalPort,
    RemoteAddr,
    RemotePort
FROM netstat()
WHERE Name =~ 'mspaint'

Remediation Script (PowerShell)

The following PowerShell script checks the installed Paint version on a Windows endpoint, reports vulnerability status, and attempts to trigger the Microsoft Store update for Paint. It can be deployed via SCCM, Intune, Group Policy startup scripts, or run manually by helpdesk staff.

PowerShell

#Requires -RunAsAdministrator
# CVE-2026-83844 — Microsoft Paint RCE Remediation Script
# Checks Paint version and attempts Store-based update
# Fixed version: 11.2609.401.0

$FixedVersion = [version]"11.2609.401.0"
$ReportPath = "C:\ProgramData\SecurityReports"
$ReportFile = Join-Path $ReportPath "Paint_CVE-2026-83844_$(Get-Date -Format 'yyyyMMdd_HHmmss').json"

# Create report directory
if (-not (Test-Path $ReportPath)) {
    New-Item -Path $ReportPath -ItemType Directory -Force | Out-Null
}

Write-Host "=== CVE-2026-83844 Paint Vulnerability Assessment ===" -ForegroundColor Cyan
Write-Host "Checking installed Microsoft Paint version..." -ForegroundColor Yellow

# --- Method 1: Check via Get-AppxPackage (most reliable for Store apps) ---
$PaintPackage = Get-AppxPackage -Name "Microsoft.Paint" -AllUsers -ErrorAction SilentlyContinue

if ($null -eq $PaintPackage) {
    Write-Host "[INFO] Microsoft.Paint AppX package not found. Checking legacy mspaint.exe..." -ForegroundColor Yellow

    # Check for legacy Paint in System32
    $LegacyPaint = Get-Item "C:\Windows\System32\mspaint.exe" -ErrorAction SilentlyContinue
    if ($LegacyPaint) {
        $LegacyVersion = [version]$LegacyPaint.VersionInfo.ProductVersion
        Write-Host "[WARN] Legacy Paint found: version $LegacyVersion" -ForegroundColor Red
        Write-Host "[WARN] This may be a legacy installation. Verify Store-based Paint is deployed." -ForegroundColor Red
        $Status = "LEGACY_PAINT_FOUND"
        $CurrentVersion = $LegacyVersion.ToString()
    } else {
        Write-Host "[INFO] No Paint installation found on this system." -ForegroundColor Green
        $Status = "NOT_INSTALLED"
        $CurrentVersion = "N/A"
    }
} else {
    $CurrentVersion = [version]$PaintPackage.Version
    Write-Host "[INFO] Found Microsoft Paint version: $CurrentVersion" -ForegroundColor Cyan

    if ($CurrentVersion -ge $FixedVersion) {
        Write-Host "[PASS] Paint version $CurrentVersion is patched against CVE-2026-83844." -ForegroundColor Green
        $Status = "PATCHED"
    } else {
        Write-Host "[FAIL] Paint version $CurrentVersion is VULNERABLE to CVE-2026-83844." -ForegroundColor Red
        Write-Host "[ACTION] Fixed version is $FixedVersion. Attempting update..." -ForegroundColor Yellow
        $Status = "VULNERABLE"

        # Attempt to trigger Microsoft Store update for Paint
        Write-Host "Attempting winget update..." -ForegroundColor Yellow
        try {
            $wingetResult = winget upgrade --id "9PCFS5B6T72H" --accept-source-agreements --accept-package-agreements --silent 2>&1
            Write-Host "Winget output: $wingetResult" -ForegroundColor Cyan

            # Re-check version after update attempt
            Start-Sleep -Seconds 5
            $PaintPackagePost = Get-AppxPackage -Name "Microsoft.Paint" -AllUsers -ErrorAction SilentlyContinue
            if ($null -ne $PaintPackagePost) {
                $PostVersion = [version]$PaintPackagePost.Version
                if ($PostVersion -ge $FixedVersion) {
                    Write-Host "[SUCCESS] Paint updated to $PostVersion. CVE-2026-83844 is remediated." -ForegroundColor Green
                    $Status = "REMEDIATED"
                    $CurrentVersion = $PostVersion.ToString()
                } else {
                    Write-Host "[WARN] Winget update did not bring Paint to $FixedVersion. Current: $PostVersion" -ForegroundColor Red
                    Write-Host "[ACTION] Manual intervention required. Open Microsoft Store and update Paint manually." -ForegroundColor Red
                    $Status = "UPDATE_FAILED_MANUAL_REQUIRED"
                }
            }
        } catch {
            Write-Host "[ERROR] Winget not available or update failed: $_" -ForegroundColor Red
            Write-Host "[ACTION] Attempting alternative: Trigger Store auto-update via COM..." -ForegroundColor Yellow

            # Alternative: Trigger Store update check
            try {
                $namespace = "Root\CIMv2\mdm\dmmap"
                $class = "MDM_EnterpriseModernAppManagement_AppManagement01"
                $result = Get-CimInstance -Namespace $namespace -ClassName $class -ErrorAction SilentlyContinue
                if ($result) {
                    Write-Host "[INFO] MDM-based app management detected. Push update via Intune or MDM." -ForegroundColor Cyan
                } else {
                    Write-Host "[ACTION] Open Microsoft Store > Library > Get Updates to update Paint manually." -ForegroundColor Yellow
                    Write-Host "[ACTION] Or deploy via: winget install --id 9PCFS5B6T72H" -ForegroundColor Yellow
                }
            } catch {
                Write-Host "[ACTION] Open Microsoft Store and update Paint manually." -ForegroundColor Yellow
            }
        }
    }
}

# --- Generate JSON report ---
$Report = @{
    ComputerName = $env:COMPUTERNAME
    Timestamp = (Get-Date -Format "o")
    CVE = "CVE-2026-83844"
    Component = "Microsoft Paint"
    CurrentVersion = $CurrentVersion
    RequiredVersion = $FixedVersion.ToString()
    Status = $Status
    StoreUpdateMechanism = "Microsoft Store / winget (NOT Windows Update)"
    RemediationCommand = "winget upgrade --id 9PCFS5B6T72H"
}

$Report | ConvertTo-Json | Out-File -FilePath $ReportFile -Encoding UTF8
Write-Host "`nReport saved to: $ReportFile" -ForegroundColor Cyan

# --- Optional: Check if Microsoft Store is disabled via GPO ---
$StorePolicy = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore" -Name "RemoveWindowsStore" -ErrorAction SilentlyContinue
if ($StorePolicy -and $StorePolicy.RemoveWindowsStore -eq 1) {
    Write-Host "`n[CRITICAL] Microsoft Store is DISABLED via Group Policy on this machine!" -ForegroundColor Red
    Write-Host "[CRITICAL] Paint cannot receive updates through the Store. You must either:" -ForegroundColor Red
    Write-Host "  1. Temporarily re-enable the Store to push the update" -ForegroundColor Yellow
    Write-Host "  2. Deploy the updated .msixbundle via Intune/SCCM sideloading" -ForegroundColor Yellow
    Write-Host "  3. Remove Paint from endpoints if not business-critical" -ForegroundColor Yellow
}

Write-Host "`n=== Assessment Complete ===" -ForegroundColor Cyan

Remediation

Immediate Actions (Within 24 Hours)

Inventory all endpoints for vulnerable Paint versions. Run the PowerShell script above across your fleet via SCCM, Intune, or your preferred deployment tool. You cannot remediate what you cannot see, and traditional patch management tools will not report this gap.
Push the Paint update via winget at scale. The Paint package ID in the Microsoft Store is 9PCFS5B6T72H. Deploy the following command through your endpoint management platform:
Code

winget upgrade --id 9PCFS5B6T72H --accept-source-agreements --accept-package-agreements --silent

Code


3. **Identify machines with the Microsoft Store disabled.** Query Group Policy, Intune configuration profiles, and local registry settings for `HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore\RemoveWindowsStore = 1`. These machines cannot receive the update through the Store and require alternative deployment methods (sideloading the .msixbundle via Intune or SCCM, or temporarily re-enabling the Store).

4. **Alert your SOC.** Provide the Sigma rules and KQL queries above to your detection engineering team. Ensure that any anomalous child process spawning from `mspaint.exe` or network connections originating from `mspaint.exe` generate immediate high-priority alerts.

### Short-Term Actions (Within 1 Week)

5. **Establish a Store-app patching process.** If your organization does not already have one, this vulnerability is a wake-up call. Paint, Notepad, Snipping Tool, Calculator, and other inbox apps are now maintained through the Store, and each one represents a potential attack surface that Windows Update will not patch. Work with your endpoint management team to establish a recurring process for auditing and updating Store-delivered applications.

6. **Update your vulnerability management scope.** Ensure your vulnerability scanning platform (Tenable, Qualys, Rapid7, etc.) is configured to detect and report on Store-delivered application versions, not just traditional Windows components. Many scanners focus on OS-level patches and will miss Store app vulnerabilities entirely.

7. **Evaluate Paint necessity.** In most enterprise environments, Paint is not a business-critical application. Consider whether Paint can be removed or restricted on endpoints where it is not needed. The command to remove Paint is:

winget uninstall --id 9PCFS5B6T72H