Skip to content
eastbaycyber

Microsoft Paint RCE fix reaches Store, not Windows Update

Breaking news 5 min read
EC
East Bay Cyber Editorial Team Updated Developing story
Built from the vendor or authority notice plus independent reporting; unconfirmed claims are labeled as reported. Human-reviewed after publishing.

TL;DR - Microsoft identifies CVE-2026-83844 as an out-of-bounds read in Windows Paint that allows remote code execution over a network. - Microsoft lists the fixed Paint build as 11.2609.401.0, while the CVE record still lists versions below 11.2605.91.0 as affected. - The fix is delivered through Microsoft Store updates, not Windows Update. - Paint copies are installed per user, and Windows can also retain a provisioned copy for new profiles. - Microsoft says the vulnerability was not publicly disclosed or exploited at publication, and rates exploitation as less likely.

What happened#

Microsoft published CVE-2026-83844 on October 13, 2026. Its Security Update Guide describes an out-of-bounds read in Windows Paint that allows an unauthorized attacker to execute code over a network. Microsoft rates the issue Important and assigns a CVSS base score of 8.1, with a temporal score of 7.1.

Microsoft’s advisory identifies the attack vector as network-based, with high attack complexity, no required privileges and no user interaction. Its exploitation assessment says the issue was not publicly disclosed, was not exploited, and was less likely to be exploited at the time of publication.

The update path is separate from Windows Update. Paint is distributed as a Microsoft Store app, and the fix arrives when the Store updates the application. The Hacker News reports that a test virtual machine later received the fixed build through Store auto-update, but says it is not clear how quickly other PCs will receive it.

The current fixed build identified in Microsoft’s security data is 11.2609.401.0. However, the NVD record still lists Microsoft Paint as affected below 11.2605.91.0. That discrepancy matters for vulnerability-management systems that rely on the CVE record.

Are you affected#

Microsoft’s affected-product entry covers Microsoft Paint versions from 11.0.0.0 up to, but not including, 11.2605.91.0, according to NVD. Microsoft’s security data, as reported by RFF, identifies 11.2609.401.0 as the build to use.

Organizations should inspect all copies of Paint on managed Windows devices. Store applications can be installed separately for each user account. Windows can also retain a provisioned Paint copy that is installed for new user profiles.

The latest version cited before Store availability changed was 11.2605.81.0. A Microsoft Q&A post dated October 30 stated that the current latest version was 11.2605.81.0 and that 11.2605.91.0 could not be located through Store distribution channels. The post links to Microsoft’s advisory but contains no Microsoft response confirming availability.

RFF reported on November 6 that the Store catalog returned 11.2609.401.0 for the United States, United Kingdom and Germany at 04:14 UTC. The Hacker News separately reported that the build was the newest Paint build in all ten countries it checked.

What is confirmed and what is reported#

Claim Source Status
CVE-2026-83844 affects Windows Paint and involves an out-of-bounds read that allows remote code execution over a network. Microsoft Security Update Guide Confirmed
Microsoft rates the vulnerability Important and assigns a CVSS base score of 8.1. Microsoft Security Update Guide Confirmed
Microsoft says the vulnerability was not publicly disclosed or exploited at publication, with exploitation assessed as less likely. Microsoft Security Update Guide Confirmed
Microsoft identifies 11.2609.401.0 as the fixed Paint build in its security data. RFF report Reported
The fix is delivered through Microsoft Store updates rather than Windows Update. RFF report, The Hacker News Reported
The Microsoft Store offered 11.2609.401.0 on November 6, 2026. RFF report Reported
The CVE record lists Microsoft Paint versions below 11.2605.91.0 as affected. NVD Confirmed
Paint is installed separately for user accounts and can have a provisioned copy for new profiles. The Hacker News Reported
Microsoft Q&A listed 11.2605.81.0 as the current version on October 30 and said 11.2605.91.0 could not be located through Store channels. Microsoft Q&A Confirmed

What defenders should do now#

  1. Inventory Microsoft Paint on managed Windows devices, checking every user’s installed copy and the provisioned copy used for new profiles.

  2. Compare each copy with Microsoft’s current fixed build, 11.2609.401.0. The CVE record and Microsoft’s current security data do not identify the same fixed-version threshold, so document which reference your scanner uses.

  3. Trigger the Microsoft Store application update process through the organization’s device-management tooling, or allow Store auto-update to install 11.2609.401.0 where it is available.

  4. Check the installed versions again after the update process. Confirm that user-specific copies and the provisioned copy have been considered, rather than checking only the signed-in user’s installation.

  5. Review vulnerability-scanner results for Paint version logic. A scanner using the CVE record may treat 11.2605.91.0 and later as fixed, while Microsoft’s current security data identifies 11.2609.401.0.

  6. If the Store does not yet offer 11.2609.401.0 on a device, record that state and check the Store again. RFF reported that availability changed between November 5 and November 6.

  7. Where Paint is not needed, review Microsoft’s advisory and organizational application-management procedures for temporary removal options. The Hacker News reports that no workaround or mitigation is listed in the advisory.

This advisory is informational and is updated as vendors publish details. Confirm versions and actions against the vendor’s own guidance for your environment.

Sources

Last verified: 2026-11-06

Disclaimer: This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.