Microsoft lowered its assessment of the Windows 11 Paint vulnerability CVE-2026-83844 on November 7, 2026. The revised rating is CVSS 3.1 7.0 (High), with a local attack vector and user interaction required. The Microsoft Security Update Guide identifies Paint 11.2609.401.0 as the fixed build.
What changed in Microsoft's Paint advisory
Microsoft classifies the flaw as a CWE-125 out-of-bounds read: Paint can read beyond the memory area it is supposed to access. The potential impact is code execution, which could allow an attacker to run code through the vulnerability.
CVSS, the Common Vulnerability Scoring System, provides a standardized severity rating. In this case, Microsoft's revision changed both the score and the conditions under which an attack could succeed. Dark Reading reported the advisory's original publication date and subsequent revision:
| Microsoft assessment | CVSS 3.1 score | Attack vector | User interaction |
| Initial advisory, October 13, 2026 | 8.1 | Network | Not required |
| Revised assessment, November 7, 2026 | 7.0 | Local | Required |
A local attack vector involves activity on the affected computer, rather than a direct attack against a network-facing service. Microsoft also rates the attack complexity as high and says no privileges are required. Required user interaction adds another condition to exploitation; the vulnerability retains a High severity rating.
The original network description drew skeptical questions on Reddit about how Paint could be attacked over a network. Microsoft's revised assessment replaced that initial network-based, no-interaction description.
As of November 7, 2026, Microsoft listed no known exploitation or public disclosure, according to Dark Reading.
How to check your Paint version in Windows 11
Microsoft lists Paint versions below 11.2609.401.0 as affected and identifies that build as corrected. This supersedes the earlier 11.2605.91.0 threshold cited by Hipertextual. If you're comparing version numbers from different reports, use Microsoft's current fixed-build threshold.
Paint receives its app updates through Microsoft Store, according to SOCRadar. That gives the app a separate update channel from the operating system.
Check Paint's own version number, even when Windows Update says your PC is up to date.
To check the installed package and apply an offered update:
- Open Settings > Apps > Installed apps in Windows 11.
- Search for Paint and read the version number beneath the app name.
- If the version is older than 11.2609.401.0, open Microsoft Store, check for app updates and install the Paint update if offered.
- Return to the installed-apps list and check the version again. It should be 11.2609.401.0 or newer.
