CVE-2026-83844 - Windows Paint Remote Code Execution Vulnerability Detection
CVE-2026-83844 is an out-of-bounds read remote code execution vulnerability in Windows Paint (mspaint.exe). This CrowdStrike Falcon CQL query works as both a detection and a threat hunting query. It surfaces suspicious mspaint.exe behavior that may indicate exploitation. Paint is an image editor and has little legitimate reason to launch programs, write executables or scripts, or connect to remote hosts. How it detects The query reads Windows endpoint telemetry from ProcessRollup2, NewExecutableWritten, NewScriptWritten, DnsRequest, NetworkConnectIP4 and NetworkConnectIP6 events. It matches four behaviors: 1. Process lineage (hunt): Any process where mspaint.exe is the parent (ParentBaseFileName). This includes scripting hosts such as cmd.exe, powershell.exe and wscript.exe, LOLBins, and network-capable binaries. Paint should not spawn child processes. 2. Executable or script written to disk (alert): mspaint.exe, as the context process, creating executable or script content (NewExecutableWritten, NewScriptWritten). 3. DNS lookups (alert): Domain resolution requests made by mspaint.exe (DnsRequest). 4. Outbound network connections (alert): IPv4 and IPv6 connections made by mspaint.exe (NetworkConnectIP4, NetworkConnectIP6). The two address fields are combined into one RemoteAddress field. Known benign activity mspaint.exe may contact "apsaiservices-a0fqcjc6bzbhgdcd.b02.azurefd.net" and "150.171.110.85" for telemetry. The query does not exclude these destinations, so they will appear as DNS and network events. Treat them as likely benign, but still check each hit in context. Other false positives may occur, such as legitimate Paint integrations and updates. Triage guidance Identify the file that opened Paint, such as an email attachment or a download. Review any child process command line and the hash of any dropped file. Check unfamiliar destinations and isolate the host if the activity is confirmed malicious.
CQL
