Microsoft Paint remote code execution flaw CVE-2026-83844 is fixed through the Microsoft Store, not Windows Update

TLDR

• Microsoft says Paint build 11.2609.401.0 fixes remote code execution flaw CVE-2026-83844 and recommends installing it or confirming auto-update.²
• Paint gets the fix only through the Microsoft Store, and some administrators could not find the fixed build.¹⁴⁵
• Microsoft rates it Important at CVSS 8.1 and lists it as not exploited; it is not in CISA's KEV catalogue.¹²

A fix for CVE-2026-83844, a remote code execution flaw in Windows Paint, is in the Microsoft Store, and Paint receives it only through a Store update rather than through Windows updates, The Hacker News reports.¹ Microsoft's Security Update Guide describes the flaw as an out-of-bounds read in Windows Paint that allows an unauthorised attacker to execute code over a network, and rates it Important with a CVSS score of 8.1.² A second revision of the entry, dated 6 November, says Microsoft released a new version of Paint, build 11.2609.401.0, to comprehensively address the vulnerability, and recommends installing it or ensuring it was automatically updated.²

The advisory says an unauthenticated attacker could exploit the flaw by sending a specially crafted packet to an affected service over the network, with no authentication or user interaction required; The Hacker News notes that it does not name the service.¹² Microsoft rates attack complexity as high and says successful exploitation requires a deep understanding of the system.² Neowin instead describes a specially crafted image as the way to trigger the flaw.⁴ Microsoft's entry lists the flaw as not exploited, with an exploitability assessment of Exploitation Less Likely.² The Hacker News says it was not known to be exploited or publicly disclosed when Microsoft published it on 13 October, and was not in the Known Exploited Vulnerabilities catalogue run by the US Cybersecurity and Infrastructure Security Agency when it checked on 6 November.¹ Windows Latest says it is not seeing reports of exploitation in the wild.⁵ The NVD entry, which is still undergoing analysis, carries CISA coordinator data recording exploitation as none, automatable as no and technical impact as total, timestamped 13 October.³

Reports differ on how easy the fixed build is to obtain and which build counts as fixed. The Hacker News says 11.2609.401.0 was the newest Paint build in all ten countries it checked on 6 November, whereas Brian Vitko of RFF, a device-management software maker, found 11.2605.81.0, which lacks the fix, to be the newest in six countries earlier that week.¹ His test virtual machine has since moved to the fixed build through Store auto-update, which The Hacker News notes is one machine, adding that how quickly other PCs will receive it is not yet clear.¹ Neowin cited a Microsoft Q&A post and Reddit threads in which administrators said the Store still offered 11.2605.81.0 after checking for updates and running WSReset, and relayed a commenter's claim that the patched build was available only in South Asian regions.⁴ Windows Latest says its own PC, with Store auto-updates turned on, was running 11.2603.251.0 with no update offered, and that IT admins on Reddit did not see the update even when using a third-party tool to download the app's MSIX package.⁵

The version Microsoft names has also changed. The Hacker News, citing a Microsoft Q&A question, says the advisory gave 11.2605.91.0 as the fixed build as recently as the week before, and that the CVE record and NVD entry still listed Paint as affected only below that build, with the advisory's revision history showing only its 13 October entry.¹ Neowin reported on 4 November that the Security Update Guide already named 11.2609.401.0, while the entry's second revision announcing that build is dated 6 November, and the NVD entry now lists Paint as affected below 11.2609.401.0.²³⁴ The Hacker News says Paint, like other Store apps, is installed separately for each user account and Windows can keep a provisioned copy for new users, so checking only the signed-in account can miss older copies.¹ It says the advisory lists no workaround or mitigation, and that before the fix reached the Store, Vitko suggested removing Paint where nobody needs it, a step he did not test.¹

Why it matters: a fully updated Windows installation does not guarantee Paint is fixed, and with no workaround listed, each copy's build has to be checked.¹⁵