Microsoft’s fix for CVE-2026-83844, a remote code execution flaw in the Windows Paint app, is now available, but only through the Microsoft Store. Paint is a Store app, so Windows Update does not install the fix. The Hacker News reports the fixed build, 11.2609.401.0, was the newest Paint build in all ten countries it checked on November 6. The flaw is an out-of-bounds read that Microsoft rates Important, with a CVSS score of 8.1. Microsoft says an attacker could trigger it with “a specially crafted packet to an affected service over the network”, needing no sign-in and no user action, though it does not name the service and notes that a successful attack requires a deep understanding of the target system.
Microsoft published the flaw on October 13 and did not know of any exploitation or public disclosure at that time. The Hacker News also reports it was not in CISA’s Known Exploited Vulnerabilities catalog when it checked on November 6.
The fix was slow to appear. Brian Vitko of RFF, a device-management software maker, found earlier this week that the newest Paint build in six Store regions was 11.2605.81.0, which lacks the fix. His write-up says the fixed build has changed once: Microsoft first named 11.2605.91.0, which he says never appeared anywhere, and by November 4 had replaced it with 11.2609.401.0 in its machine-readable security data, without a revision note. The public CVE record and the NVD entry still list Paint as affected only below 11.2605.91.0, so a vulnerability scanner that reads the CVE record could treat builds from 11.2605.91.0 up as fixed. A copy at 11.2609.401.0 or later passes under both numbers.
How to check if you’re affected
Affected products are any Windows PC with the Microsoft Store version of Paint below build 11.2609.401.0. Paint is installed separately for each user account, and Windows can also keep a provisioned copy that it installs for each new user, so a check of only the signed-in account can miss older copies.
Vitko’s write-up gives two commands to run in a PowerShell window opened as administrator. The first lists every user’s copy of Paint and its version, and the second lists the provisioned copy:
Get-AppxPackage -AllUsers -Name Microsoft.Paint | Select-Object Version, @{ n = 'Users'; e = { $_.PackageUserInformation.UserSecurityId.Username -join ', ' } }
Get-AppxProvisionedPackage -Online | Where-Object DisplayName -eq 'Microsoft.Paint' | Select-Object Version
For any copy below 11.2609.401.0, update Paint through the Store or let Store auto-update install it. In Intune and other device-management tools, the Store app update scan does this across many PCs. Then run both commands again and confirm that every copy shows 11.2609.401.0 or later. The Hacker News reports that Vitko’s test virtual machine moved to the fixed build on its own through Store auto-update, but that is one machine and it is not yet clear how fast other PCs will get the build.
The advisory lists no workaround or mitigation. Before the fix reached the Store, Vitko suggested removing Paint where nobody needs it, for every user and from the provisioned copy; he did not test that step, and his update says removal is no longer needed once the fixed build is installed.
Sources
- RFF (Brian Vitko): Windows Paint CVE-2026-83844: the fixed build is in the Microsoft Store now
- Microsoft Security Update Guide: CVE-2026-83844 (the page is JavaScript-rendered and did not load text for us; build numbers here are as reported by The Hacker News and RFF)
- NVD: CVE-2026-83844 (JavaScript-rendered; not read directly)
- Microsoft Q&A: Microsoft Paint 11.2605.91.0
- The Hacker News: Microsoft Paint RCE Fix Now Available, but Windows Update Won’t Deliver It