# Microsoft Paint Out-of-Bounds Read RCE Vulnerability (CVE-2026-83844)

> CVE-2026-83844 is an out-of-bounds read (CWE-125) in Microsoft Paint that allows an unauthenticated attacker to execute code over a network; NVD scores it CVSS 8.1 (High) with high attack complexity. Microsoft rates exploitation 'Less Likely', no in-the-wild exploitation or public PoC is reported, and a fix ships via the Microsoft Store.

- **Published:** 2026-11-06T01:12:06Z
- **Last reviewed:** 2026-11-06T01:12:06Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5361
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5361.png
- **ID:** TL-2026-5361
- **Severity:** HIGH (CVSS 8.1)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 5
- **CVEs:** CVE-2026-83844

## Description

CVE-2026-83844 is an out-of-bounds read (CWE-125) in Microsoft Paint (Windows Paint), disclosed by Microsoft on 2026-10-13 as part of the October 2026 Patch Tuesday release. The NVD description reads: 'Out-of-bounds read in Windows Paint allows an unauthorized attacker to execute code over a network.' The CVSS v3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (base score 8.1, High), meaning no privileges and no user interaction are required by the scoring, but attack complexity is high.

Exploit mechanics are only thinly documented. The Cyber Security News article describes delivery as an attacker sending a 'specially crafted network packet' to an affected service and states that claims that a malicious image alone triggers the flaw remain unconfirmed. The article also says exploitation is complex, depends on environment configuration, and requires detailed system knowledge. SentinelOne and OpenCVE describe the likely trigger as processing a crafted image file shared over network services, and say successful exploitation yields code execution in the context of the Paint process. These secondary descriptions are not confirmed by the Microsoft advisory text that could be retrieved, and no specific service, port or complete attack chain has been published.

Exploitation status: Microsoft's exploitability assessment is 'Less Likely'. No in-the-wild exploitation is reported, SentinelOne observed no public proof-of-concept, the CVE is not in the CISA Known Exploited Vulnerabilities catalog, and EPSS is about 0.65% (SentinelOne). No threat actor attribution, malware, or network IOCs are associated with this CVE.

Affected versions are inconsistent between sources. NVD/OpenCVE list Microsoft Paint 11.0.0.0 through 11.2605.90.999 (fixed in 11.2605.91.0 and later). The Cyber Security News article reports that Microsoft's advisory table lists build 11.2609.401.0 and notes the mismatch, stating the Microsoft advisory should take precedence. The fix is delivered through the Microsoft Store, and some systems may not auto-update, so defenders should verify the installed package version (Get-AppxPackage Microsoft.Paint | Select-Object Name, Version).

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1570 Lateral Tool Transfer

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**CVE-2026-83844 Paint (mspaint.exe) Spawning Shell or Script Interpreter — Exploitation** (`TL-2026-5361-SPL-001`)

Detects Microsoft Paint (mspaint.exe) spawning a command shell, script host or LOLBin child process. CVE-2026-83844 (CWE-125 out-of-bounds read, CVSS 8.1) yields code execution in the context of the Paint process per SentinelOne/OpenCVE, so a child process from Paint is the most direct behavioural signal of successful exploitation. Paint has no legitimate reason to launch these binaries. No public PoC or in-the-wild exploitation is reported; the exact trigger is unconfirmed, so this is behaviour-first and independent of the delivery mechanism.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1203, T1059.001, T1059.003
- **Data sources:** sysmon, windows_security_4688
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*\\mspaint.exe" (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe" OR Image="*\\certutil.exe" OR Image="*\\bitsadmin.exe") | stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as child_command_lines values(ParentCommandLine) as parent_command_line by host, User, ParentImage, Image | convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "mspaint.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFolderPath, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
```

### Sigma

```yaml
title: Microsoft Paint Spawning Shell or Script Interpreter (CVE-2026-83844)
id: 3f8d1c59-6e2a-47b0-8a94-d1b7c5e02f63
status: experimental
description: Detects mspaint.exe spawning a shell, script host or LOLBin child process, a behavioural indicator of code execution through the Paint out-of-bounds read CVE-2026-83844 (CWE-125).
references:
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83844
    - https://nvd.nist.gov/vuln/detail/cve-2026-83844
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/06
tags:
    - attack.execution
    - attack.t1203
    - attack.t1059.001
    - attack.t1059.003
    - cve.2026-83844
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\mspaint.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
            - '\certutil.exe'
            - '\bitsadmin.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Third-party shell extensions or automation that launches helper processes from Paint
    - Penetration tests or vulnerability validation exercises against Paint
level: high
```

**Known false positives:**

- Third-party shell extensions or automation that launches helper processes from mspaint.exe
- Authorised exploit validation or red-team testing against Paint

**Tuning notes:** Requires Sysmon Event ID 1 (index/sourcetype names may differ per deployment) or Defender for Endpoint process telemetry. Add child binaries relevant to your environment (e.g. msiexec.exe, wmic.exe). Exclude documented software-deployment parents only after review; Paint rarely has a legitimate reason to spawn these.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- CVE-2026-83844 Paint Application Crash (Faulting mspaint.exe) — Exploitation Attempt (locked: unlock with TL Creds)
- CVE-2026-83844 [indicator] Package Version Enumeration via Get-AppxPackage — Exposure Check / Discovery (locked: unlock with TL Creds)
- CVE-2026-83844 Inbound Network Connection or Listener on Paint (mspaint.exe) — Network-Vector Exploitation (locked: unlock with TL Creds)
- CVE-2026-83844 Paint Launched with UNC, WebDAV or URL Path Argument — Crafted Image Delivery (locked: unlock with TL Creds)
- CVE-2026-83844 Paint (mspaint.exe) Writing Run-Key Persistence — Post-Exploitation (locked: unlock with TL Creds)
- CVE-2026-83844 Paint (mspaint.exe) Connecting to SMB, RPC, RDP or WinRM Ports — Lateral Movement (locked: unlock with TL Creds)
- CVE-2026-83844 Paint (mspaint.exe) Writing Executable or Script Files — Post-Exploitation Payload Staging (locked: unlock with TL Creds)
- CVE-2026-83844 Paint (mspaint.exe) Outbound Connection to Public IP — Command and Control (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Microsoft Paint 0-Click Vulnerability Could Allow Hackers to Take Control of Windows PCs](https://cybersecuritynews.com/windows-paint-rce-vulnerability/)
- [MSRC Security Update Guide - CVE-2026-83844](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83844)
- [NVD - CVE-2026-83844](https://nvd.nist.gov/vuln/detail/cve-2026-83844)
- [SentinelOne Vulnerability Database - CVE-2026-83844](https://www.sentinelone.com/vulnerability-database/cve-2026-83844/)
- [OpenCVE - CVE-2026-83844](https://app.opencve.io/cve/CVE-2026-83844)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5361