Microsoft Paint RCE fix arrives through Store, not Windows Update

A fix for CVE-2026-83844, a remote code execution flaw in Windows Paint, is now available in the Microsoft Store. The update arrives only through the Store, not via Windows Update, and Microsoft rates the vulnerability as Important with a CVSS score of 8.1. The flaw is an out-of-bounds read that could let an attacker run code over a network; Microsoft stated that a successful exploit would require a deep understanding of the target system.

The advisory noted the vulnerability was not publicly disclosed or known to be exploited when first published on 13 October. The fixed Paint build is 11.2609.401.0, with the CVE’s own records still listing affected builds up to 11.2605.91.0, meaning any 11.2605.91.0 and later can be considered fixed per the advisories and the NVD entry.

Evidence from independent testing indicated that the most recent Store offerings in six countries included 11.2605.81.0 prior to the fix, and one test machine subsequently moved to the fixed build via Store auto-update. The article notes that Paint is installed per user and provisioned per device, so a comprehensive check requires examining all user copies and the provisioned copy.

Two PowerShell commands are provided to enumerate all copies and verify versions, with instructions to update any copy below 11.2609.401.0 and re-check. The advisory provides no workaround; prior to the Store fix, removing Paint was suggested by Brian Vitko of RFF as a potential mitigation, though not tested in the article.

The piece also clarifies that exploitation could occur without sign-in or user interaction, and that the vulnerability had not appeared in the US CISA Known Exploited Vulnerabilities catalog at the time of reporting. Claims are attributed to Microsoft’s advisory, Vitko’s test write-up, and The Hacker News reporting.