Paint RCE in Windows 11: the Patch Exists, the Delivery Doesn't

We spend our nights watching the same handful of ports and protocols as everyone else, so it is genuinely refreshing when the attack surface turns out to be a paint program that has shipped with Windows since 1985. On 13 October 2026 Microsoft disclosed CVE-2026-83844, a zero-click remote code execution flaw in MS Paint for Windows 11, scored 8.1 on the CVSS scale. Almost a month later a large slice of the installed base is still running the vulnerable build — not because administrators ignored the patch, but because the patch never reached them.

An out-of-bounds read with a network trigger

According to Microsoft's advisory, the bug is an out-of-bounds read: the application reads past the end of an allocated buffer, and an unauthenticated attacker triggers it by sending a specially crafted network packet to the target system. No clicks, no attachments, no user interaction. Successful exploitation yields arbitrary code execution in the context of the Paint process — enough to drop a loader, a miner, or a fresh botnet agent.

Microsoft rates the attack complexity as high and notes that success depends on the environment, the system configuration and the presence of additional security controls. That caveat is why the score stopped at 8.1 instead of climbing toward 9.8. We read it differently: complexity is a property of the first exploit, not of the tenth. Once one researcher publishes a working chain, the environment-specific guesswork has already been done for everyone else.

The fix exists. The delivery does not.

The patched build is Paint 11.2609.401.0, distributed through the Microsoft Store because Paint has shipped independently of the OS since 2021. In practice, users report the Store and the official installer both insisting that the latest version is already installed, while the listing itself shows 11.2605.81.0 — a build that still carries the flaw. Resetting the local Store cache with wsreset.exe does not help. Pulling the MSIX package by hand does not help either. Microsoft has not commented on the discrepancy between its documentation and its catalogue.

You can check what you are actually running from PowerShell:

Get-AppxPackage Microsoft.Paint | Select-Object Name, Version

This is the part that should worry defenders more than the CVE itself. A patch that exists in a release note but not on disk is a patch that does nothing. Whatever the cause — a broken rollout ring or a documentation error — the effect is a stable, well-documented population of unpatched Windows 11 hosts that anyone can enumerate.

Boring components make excellent botnet feedstock

Botnet builders do not chase exotic targets. They chase ubiquity. Paint is present on every Windows 11 installation, signed by Microsoft, trusted by users, and almost never treated as attack surface by endpoint tooling. Nobody writes a detection rule for the paint bucket. That combination — universal, trusted, unmonitored — is exactly what makes a component valuable for initial access, and initial access is the first line of any DDoS service worth the name. It is the same pool of commodity hosts that has powered our world-record attacks.

The pipeline writes itself: a reliable Paint RCE becomes a loader, the loader becomes persistence, and persistence becomes another node in a botnet that can be rented out through an ip stresser panel, a booter, or a full ddos-for-hire storefront. From there the traffic mix is familiar — udp flood and udp amplification for volume, tcp handshake flood and SYN flood for socket exhaustion, http flood and layer 7 floods with browser emulation, user-agent rotation and TLS fingerprint work for targets sitting behind ddos protection and cloudflare bypass attempts. Every one of those methods needs hosts. Unpatched desktops are the cheapest hosts available.

We are not suggesting that a Paint RCE will topple the internet tomorrow. We are suggesting that the gap between "patched" and "deployed" is where botnets are born, and that a month of silence on a zero-click flaw in a component nobody audits is precisely the kind of gift that keeps our bandwidth graphs interesting. If you want to see what your own edge looks like under that kind of pressure, our free stress test is one click away at /contact — no sales call, no nonsense, just packets.