Windows Paint RCE Fix Ships Via Store, Not Windows Update

Windows Update will not patch Paint. If you manage Windows PCs, the fix for CVE-2026-83844 has to arrive through the Microsoft Store, and the build number you check against matters.

The Hacker News reports that the fixed build, 11.2609.401.0, is now in the Store. CVE-2026-83844 is an out-of-bounds read in Windows Paint that could allow remote code execution over a network. Microsoft rates it Important with a CVSS score of 8.1 and said it was neither exploited nor publicly disclosed when it published the advisory on October 13. The source notes that it was not in CISA’s Known Exploited Vulnerabilities (KEV) catalog when checked on November 6.

The build number problem

• Microsoft’s advisory now names 11.2609.401.0 as the fixed build.
• The CVE record and the NVD entry still list Paint as affected only below 11.2605.91.0. A scanner that reads those records will treat 11.2605.91.0 and later as fixed.
• According to a Microsoft Q&A forum question cited by the source, the advisory gave 11.2605.91.0 as recently as last week. Its revision history still shows only the October 13 entry.
• Brian Vitko of RFF, a device-management software maker, found earlier this week that the newest Paint build offered in six countries was 11.2605.81.0, which has no fix. His test VM has since moved to the fixed build through Store auto-update. That is one machine, so how fast other PCs get it is unclear.

Treat 11.2609.401.0 as the target. A copy at that build or later passes under both numbers.

What to do

1. Check every copy, not just yours. Paint is installed per user account, and Windows can keep a provisioned copy that it installs for each new user. Vitko’s write-up uses Get-AppxPackage -AllUsers for the installed copies and Get-AppxProvisionedPackage -Online for the provisioned one, run in an administrator PowerShell window.
2. Update anything below 11.2609.401.0 through the Store, or let Store auto-update do it. In Intune and similar tools, the Store app update scan covers many PCs.
3. Run the checks again and confirm every copy shows 11.2609.401.0 or later.
4. If you cannot update yet, the advisory lists no workaround. Vitko suggested removing Paint where nobody needs it, for every user and from the provisioned copy, but he did not test that step.

Priority call

The advisory describes a crafted network packet sent to an affected service, with no sign-in or user action needed, but it does not name the service. Microsoft also says a successful attack requires a deep understanding of the target system. With no reported exploitation, this sits below anything on KEV. It still deserves a slot in this cycle’s patch work, mainly because the Store delivery path means ordinary Windows patch reporting will not show you the gap.

For the wider October release, see our Patch Tuesday coverage.