{"id":"EM-20261112-HFVR","url":"https://cyber.eventmonitor.net/incident/EM-20261112-HFVR/windows-paint-vulnerability-cve-2026-83844/","type":"cve","title":"Windows Paint Vulnerability (CVE-2026-83844)","subtitle":"CVE-2026-83844","subject":"CVE-2026-83844","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-12T04:49:41.000Z","firstSignal":"2026-11-06T12:06:43.000Z","lastSignal":"2026-11-12T04:49:41.000Z","updated":"2026-11-12T15:50:47.989Z","revision":1,"life":[{"status":"Born","at":"2026-11-12T04:49:41.000Z","why":"second independent source: C31 Vulners (new public exploits)"},{"status":"Developing","at":"2026-11-12T04:49:41.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-06T12:06:43.000Z","what":"First signal: C130 The Hacker News"},{"at":"2026-11-12T04:49:41.000Z","what":"Born: second source, C31 Vulners (new public exploits). Page EM-20261112-HFVR created."},{"at":"2026-11-12T04:49:41.000Z","what":"Severity raised to High by C31"}],"stages":[{"name":"Disclosed","at":"2026-10-13T19:20:32.890Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-10-13T19:20:32.890Z","detail":"CVSS 7 · EPSS 0.7%"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-06T12:06:43.000Z","source":"C130","sourceName":"The Hacker News","role":"Research & News","severity":2,"title":"Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It","text":"A fix for CVE-2026-83844, a remote code execution flaw in Windows Paint, is now in the Microsoft Store. Paint gets this fix only through a Store update, not through Windows updates. The fixed build, 11.2609.401.0, was the newest Paint build in all ten countries The Hacker News checked today. The flaw is an out-of-bounds read that could let an attacker run code over a network. Microsoft rates","url":"https://thehackernews.com/2026/11/microsoft-paint-rce-fix-now-available.html"},{"at":"2026-11-12T04:49:41.000Z","source":"C31","sourceName":"Vulners (new public exploits)","role":"Research & News","severity":3,"title":"Public exploit: Exploit for CVE-2026-83844","text":"# CVE-2026-83844 Safe Lab and Host Assessment\n\nA safe teaching model and a read-only Windows host checker for\n**CVE-2026-83844**, the Microsoft Paint out-of-bounds-read vulnerability often\ncalled **Paint2Shell** by the security community.\n\n> [!CAUTION]\n> This repository is not an RCE exploit. It…","url":"https://github.com/zake1god/CVE-2026-83844"},{"at":"2026-11-12T04:49:41.000Z","source":"C31","sourceName":"Vulners (new public exploits)","role":"Research & News","severity":3,"title":"Public exploit: Exploit for CVE-2026-83844","text":"# Paint2Shell Safe Lab and Host Assessment\n\nA safe teaching model and a read-only Windows host checker for\n**CVE-2026-83844**, the Microsoft Paint out-of-bounds-read vulnerability often\ncalled **Paint2Shell** by the security community.\n\n> [!CAUTION]\n> This repository is not an RCE exploit. It does…","url":"https://github.com/zake1god/Paint2Shell"}],"crowd":[],"reference":{"nvd":{"published":"2026-10-13T19:20:32.890","score":7,"severity":"HIGH","desc":"Out-of-bounds read in Windows Paint allows an unauthorized attacker to execute code locally.","product":"","seen":1794106977928},"kev":null,"epss":{"epss":0.00734,"pct":0.54543,"at":1793969686525},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}