Microsoft Store Delivers Paint Fix for CVE-2026-83844
Microsoft has made Paint version 11.2609.401.0 available through the Microsoft Store to address CVE-2026-83844, a remote code execution vulnerability in the Windows application. The company rates the issue Important with a CVSS score of 8.1. The update is not distributed through Windows Update, making Store servicing the relevant patch channel for affected devices.
The fixed build was the newest Paint release offered in ten countries checked by The Hacker News. Earlier testing by Brian Vitko of device-management software maker RFF found Store installations offering version 11.2605.81.0, which did not contain the fix, across six countries. Vitko later observed one test virtual machine updating automatically to the fixed release, but the timing for broader rollout remains unclear.
A network-triggered code execution issue
Microsoft describes CVE-2026-83844 as an out-of-bounds read. An attacker could exploit it by sending a specially crafted packet to an affected service over the network. The advisory does not identify that service.
The attack requires neither authentication nor user interaction. Microsoft also says successful exploitation requires an attacker to have a deep understanding of the target system. When Microsoft published the vulnerability on October 13, it was not publicly disclosed and was not known to have been exploited.
The issue was not listed in the U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog when The Hacker News checked. That status does not change the need to deploy the available update, particularly because Microsoft provides no workaround or mitigation in its advisory.
Version records create a verification problem
Microsoft's security advisory identifies 11.2609.401.0 as the fixed Paint build. However, the CVE record and the National Vulnerability Database entry describe affected versions as those below 11.2605.91.0. A scanner relying only on that range could therefore regard releases from 11.2605.91.0 onward as fixed, even though the advisory points administrators to a newer build.
Microsoft's advisory reportedly named 11.2605.91.0 as the fixed version as recently as the prior week, based on a question posted to Microsoft Q&A. Its revision history still shows only the October 13 entry and does not record the version change. For a consistent operational threshold, version 11.2609.401.0 or later satisfies both version references.
Check all user and provisioned installations
Paint is a Store app installed separately for each user account. Windows can also retain a provisioned package that is installed for newly created users. Checking only the account currently signed in can therefore leave an older Paint copy undetected.
Administrators can open PowerShell as an administrator and use the following commands to inspect all user installations and the provisioned package.
- Get-AppxPackage -AllUsers -Name Microsoft.Paint | Select-Object Version, @{ n = 'Users'; e = { $_.PackageUserInformation.UserSecurityId.Username -join ', ' } }
- Get-AppxProvisionedPackage -Online | Where-Object DisplayName -eq 'Microsoft.Paint' | Select-Object Version
Any copy below 11.2609.401.0 should be updated through the Microsoft Store or allowed to receive the Store auto-update. In Intune and other device-management platforms, a Store app update scan can apply the update across many PCs. Businesses should rerun both checks after deployment and confirm that every user-level and provisioned copy reports version 11.2609.401.0 or later.