Windows Paint Has a Remote Code Execution Flaw, CVE-2026-83844, and Windows Update Will Not Fix It. The Fix Is a Store Update, and Microsoft's Advisory and the CVE Record Name Different Fixed Builds.
Check every copy of Microsoft Paint for version 11.2609.401.0 or later. That is the build Microsoft's advisory names as fixed for CVE-2026-83844, and Paint gets it only through a Microsoft Store update, not through Windows Update. The public CVE record still lists Paint as affected only below 11.2605.91.0, so a scanner that reads the record will call an older build fixed. Go by 11.2609.401.0. Microsoft rates the flaw Important, CVSS 8.1, and said it was not known to be exploited or publicly disclosed when it published on October 13.
What the flaw is
CVE-2026-83844 is an out-of-bounds read in Windows Paint that Microsoft classes as remote code execution. The score is CVSS 8.1, with a network vector, no sign-in, no user interaction and high attack complexity. Microsoft says a successful attack requires a deep understanding of the target system. Its FAQ describes the attack as a specially crafted packet sent to an affected service over the network, which is an odd description for an image editor, and the sources we read do not explain how that would work. We do not know the real attack path.
Why it is a patching problem
Paint is a Store app, so the fix arrives when the Store updates Paint. Microsoft marks the CVE "Customer Action Required: Yes". For several days that was hard to act on. Brian Vitko of RFF, a device-management software maker, found that the Store's product catalog offered 11.2605.81.0 as the newest Paint in six markets on November 5, which is a build without the fix. Administrators on Microsoft's Q&A forum could not find the build the advisory named on October 30 either.
The fixed build has also changed. At publication the advisory named 11.2605.91.0, which never appeared anywhere. By November 4 Microsoft's machine-readable October data named 11.2609.401.0 instead, with no revision note on the advisory, according to Vitko. The CVE record and the NVD entry still list Paint as affected only below 11.2605.91.0.
The Hacker News reports that the Store now has the fix: the catalog query that returned 11.2605.81.0 returned 11.2609.401.0 for the US, UK and Germany at 04:14 UTC on November 6, and The Hacker News says it was the newest build in all ten countries it checked that day. Vitko's test virtual machine moved to the fixed build through Store auto-update on its own. That is one machine, and how fast other PCs will follow is not yet clear.
How to check every copy
Paint is installed separately for each user account, and Windows can keep a provisioned copy that it installs for each new user, so checking only the signed-in account can miss older copies. The Hacker News and RFF give two commands to run in an administrator PowerShell window. Get-AppxPackage -AllUsers -Name Microsoft.Paint lists every user's copy with its version, and Get-AppxProvisionedPackage -Online filtered to the Microsoft.Paint display name lists the provisioned copy.
Any copy below 11.2609.401.0 should be updated through the Store, or left to Store auto-update.
In Intune and other device-management tools, the Store app update scan does this across many PCs. RFF reports that until the fix appeared in the Store, this scan had nothing newer to install.
Do not rely on a vulnerability scanner that reads the CVE record until it lists 11.2609.401.0. Treat 11.2605.91.0 as unfixed.
If you cannot update, removing Paint is an option RFF mentioned earlier in its write-up; it said removal is no longer needed now that the fixed build is available.
What is not known
Who could exploit this, and how. Whether exploitation has started; Microsoft said it was not known to be exploited when it published. Why the advisory changed its fixed build without a revision note. How quickly Store auto-update will reach all machines. The sources publish no indicators, so there is nothing to put in the feed, and we ingested nothing.
Limits
We read The Hacker News's report and RFF's write-up. We did not read Microsoft's advisory or the NVD entry directly; both are quoted by those sources. We did not test any build.
Five percent of this is wrong somewhere. It always is. If you see a different fixed build in your Store, tell us.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments