Paint RCE in Windows 11: Patch Shipped, Nobody Got It
Microsoft fixed a zero-click Paint RCE in Windows 11, yet Microsoft Store still ships the vulnerable build. A stalled patch pipeline is a gift to botnets.
CVE-2026-83844 is a zero-click out-of-bounds read in Windows 11 MS Paint that allows remote code execution with a CVSS score of 8.1. Microsoft patched it in Paint 11.2609.401.0, but Microsoft Store rollout failures left many systems on the vulnerable build.
Microsoft fixed a zero-click Paint RCE in Windows 11, yet Microsoft Store still ships the vulnerable build. A stalled patch pipeline is a gift to botnets.