Microsoft Paint Out-of-Bounds Read RCE Vulnerability (CVE-2026-83844)

Key facts for Microsoft Paint RCE

Detection coverage for Microsoft Paint RCE

As of 2026-11-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5361 across Splunk SPL, Microsoft KQL and Sigma, covering 5 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CVE-2026-83844 Paint (mspaint.exe) Spawning Shell or Script Interpreter — Exploitation

Detects Microsoft Paint (mspaint.exe) spawning a command shell, script host or LOLBin child process. CVE-2026-83844 (CWE-125 out-of-bounds read, CVSS 8.1) yields code execution in the context of the Paint process per SentinelOne/OpenCVE, so a child process from Paint is the most direct behavioural signal of successful exploitation. Paint has no legitimate reason to launch these binaries. No public PoC or in-the-wild exploitation is reported; the exact trigger is unconfirmed, so this is behaviour-first and independent of the delivery mechanism.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1203, T1059.001, T1059.003
• Data sources: sysmon, windows_security_4688
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*\\mspaint.exe" (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe" OR Image="*\\certutil.exe" OR Image="*\\bitsadmin.exe") | stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as child_command_lines values(ParentCommandLine) as parent_command_line by host, User, ParentImage, Image | convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "mspaint.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFolderPath, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256

Sigma

title: Microsoft Paint Spawning Shell or Script Interpreter (CVE-2026-83844)
id: 3f8d1c59-6e2a-47b0-8a94-d1b7c5e02f63
status: experimental
description: Detects mspaint.exe spawning a shell, script host or LOLBin child process, a behavioural indicator of code execution through the Paint out-of-bounds read CVE-2026-83844 (CWE-125).
references:
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83844
    - https://nvd.nist.gov/vuln/detail/cve-2026-83844
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/06
tags:
    - attack.execution
    - attack.t1203
    - attack.t1059.001
    - attack.t1059.003
    - cve.2026-83844
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\mspaint.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
            - '\certutil.exe'
            - '\bitsadmin.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Third-party shell extensions or automation that launches helper processes from Paint
    - Penetration tests or vulnerability validation exercises against Paint
level: high

Known false positives:

• Third-party shell extensions or automation that launches helper processes from mspaint.exe
• Authorised exploit validation or red-team testing against Paint

Tuning notes: Requires Sysmon Event ID 1 (index/sourcetype names may differ per deployment) or Defender for Endpoint process telemetry. Add child binaries relevant to your environment (e.g. msiexec.exe, wmic.exe). Exclude documented software-deployment parents only after review; Paint rarely has a legitimate reason to spawn these.

• 🔒 CVE-2026-83844 Paint Application Crash (Faulting mspaint.exe) — Exploitation Attempt · unlock with TL Creds
• 🔒 CVE-2026-83844 [indicator] Package Version Enumeration via Get-AppxPackage — Exposure Check / Discovery · unlock with TL Creds
• 🔒 CVE-2026-83844 Inbound Network Connection or Listener on Paint (mspaint.exe) — Network-Vector Exploitation · unlock with TL Creds
• 🔒 CVE-2026-83844 Paint Launched with UNC, WebDAV or URL Path Argument — Crafted Image Delivery · unlock with TL Creds
• 🔒 CVE-2026-83844 Paint (mspaint.exe) Writing Run-Key Persistence — Post-Exploitation · unlock with TL Creds
• 🔒 CVE-2026-83844 Paint (mspaint.exe) Connecting to SMB, RPC, RDP or WinRM Ports — Lateral Movement · unlock with TL Creds
• 🔒 CVE-2026-83844 Paint (mspaint.exe) Writing Executable or Script Files — Post-Exploitation Payload Staging · unlock with TL Creds
• 🔒 CVE-2026-83844 Paint (mspaint.exe) Outbound Connection to Public IP — Command and Control · unlock with TL Creds

Indicators of compromise for Microsoft Paint RCE

As of 2026-11-06, Threadlinqs Intelligence tracks 5 indicators of compromise for TL-2026-5361.

How Microsoft Paint RCE works

CVE-2026-83844 is an out-of-bounds read (CWE-125) in Microsoft Paint (Windows Paint), disclosed by Microsoft on 2026-10-13 as part of the October 2026 Patch Tuesday release. The NVD description reads: 'Out-of-bounds read in Windows Paint allows an unauthorized attacker to execute code over a network.' The CVSS v3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (base score 8.1, High), meaning no privileges and no user interaction are required by the scoring, but attack complexity is high.

Exploit mechanics are only thinly documented. The Cyber Security News article describes delivery as an attacker sending a 'specially crafted network packet' to an affected service and states that claims that a malicious image alone triggers the flaw remain unconfirmed. The article also says exploitation is complex, depends on environment configuration, and requires detailed system knowledge. SentinelOne and OpenCVE describe the likely trigger as processing a crafted image file shared over network services, and say successful exploitation yields code execution in the context of the Paint process. These secondary descriptions are not confirmed by the Microsoft advisory text that could be retrieved, and no specific service, port or complete attack chain has been published.

Exploitation status: Microsoft's exploitability assessment is 'Less Likely'. No in-the-wild exploitation is reported, SentinelOne observed no public proof-of-concept, the CVE is not in the CISA Known Exploited Vulnerabilities catalog, and EPSS is about 0.65% (SentinelOne). No threat actor attribution, malware, or network IOCs are associated with this CVE.

Affected versions are inconsistent between sources. NVD/OpenCVE list Microsoft Paint 11.0.0.0 through 11.2605.90.999 (fixed in 11.2605.91.0 and later). The Cyber Security News article reports that Microsoft's advisory table lists build 11.2609.401.0 and notes the mismatch, stating the Microsoft advisory should take precedence. The fix is delivered through the Microsoft Store, and some systems may not auto-update, so defenders should verify the installed package version (Get-AppxPackage Microsoft.Paint | Select-Object Name, Version).

MITRE ATT&CK techniques by tactic:

Initial Access

T1190 Exploit Public-Facing Application

Execution

T1203 Exploitation for Client Execution

Lateral Movement

T1570 Lateral Tool Transfer

Remediation for Microsoft Paint RCE

Patches

• Update Microsoft Paint through the Microsoft Store (fix per Microsoft advisory CVE-2026-83844; NVD lists 11.2605.91.0 and later as fixed)

Immediate actions

• Verify the installed Paint package version with: Get-AppxPackage Microsoft.Paint | Select-Object Name, Version
• Confirm the installed build meets or exceeds the fixed build in the Microsoft Security Update Guide (the Microsoft advisory takes precedence over the NVD range)

Longer-term hardening

• Ensure Microsoft Store app updates are enabled or centrally managed, since some systems do not auto-update
• Include Store-delivered inbox apps such as Paint in vulnerability and patch-compliance inventories

Affected and fixed versions

• Microsoft — Paint (Windows Paint)
  Vulnerable versions: 11.0.0.0 through 11.2605.90.999 (NVD/OpenCVE); 11.2609.401.0 (listed in Microsoft advisory table per Cyber Security News)
  Fixed in: 11.2605.91.0 and later (NVD/OpenCVE); Microsoft-published fixed build not confirmed from retrievable sources

Timeline of Microsoft Paint RCE

• 2026-08-31 CVE-2026-83844 reserved (per OpenCVE)
• 2026-10-13 CVE published to NVD: CWE-125, CVSS v3.1 8.1 (High), vector AV:N/AC:H/PR:N/UI:N; affected range Paint below 11.2605.91.0
• 2026-10-13 locked-ioc-5 publishes advisory for CVE-2026-83844 as part of October 2026 Patch Tuesday, rating exploitation 'Less Likely' with no prior public disclosure; fix delivered via the locked-ioc-4
• 2026-10-14 SentinelOne vulnerability database records the CVE as published; no public PoC observed and not in CISA KEV
• 2026-10-31 CVE record last updated per OpenCVE; NVD affected range lists Paint 11.0.0.0 through 11.2605.90.999
• 2026-11-06 Cyber Security News reports on the flaw, noting locked-ioc-5 rates exploitation 'Less Likely', no in-the-wild exploitation, and a version mismatch between locked-ioc-5 and NIST records

Sources cited for Microsoft Paint RCE

• NVD - CVE-2026-83844 NVD (NIST) · Advisory · 2026-10-13
• MSRC Security Update Guide - CVE-2026-83844 Microsoft Security Response Center · Vendor report · 2026-10-13
• SentinelOne Vulnerability Database - CVE-2026-83844 SentinelOne · Research · 2026-10-14
• OpenCVE - CVE-2026-83844 app.opencve.io · Research · 2026-10-13
• Microsoft Paint 0-Click Vulnerability Could Allow Hackers to Take Control of Windows PCs cybersecuritynews.com · News · 2026-11-06

More in vulnerability

• Marimo CVE-2026-39987: unauthenticated /terminal/ws RCE exploited to harvest AWS credentials and pivot to an SSH bastion in 8 seconds
• Scans for Cisco IOS XE Web UI Vulnerability (CVE-2023-20198) with RootEvidence Opt-Out Headers
• OpenSSH on musl libc (Alpine Linux) authentication bypass via overly long password ("*sshole")
• Apache OFBiz Pre-Auth RCE (CVE-2026-68524) and Account Takeover (CVE-2026-109928) Patched in 24.09.08
• ChatGPT Lockdown Mode Bypass via HTML Preview Nested Iframes Enables Phishing, Malware Delivery, and Silent Data Exfiltration