Microsoft patches Windows Paint flaw after update confusion

Microsoft has released a patch for a remote code execution flaw in Windows Paint, tracked as CVE-2026-83844. The vulnerability is described by Microsoft as an out-of-bounds read that could allow an unauthorised attacker to run code locally, with a high severity CVSS 3.1 score of 7.0. Defence details from the advisory are limited; Microsoft says exploitation requires local access and some user interaction, which helps explain why the severity is not higher. There have been no reported exploitation attempts at the time of the update.

A fix is now available: Paint version 11.2609.401.0, which users can obtain via Paint > Settings > About, or through the Microsoft Store with automatic updates enabled. Microsoft confirmed the Store update and urged customers to ensure they are on the latest version to stay protected, with manual update possible via Microsoft Store App > Downloads > Check for updates.

The vulnerability has a curious timeline: Microsoft first disclosed the bug on 13 October, but there was confusion over whether the fix listed in October (11.2605.91.0) was live. By 4 November, the correct fixed version was noted in the advisory (11.2609.401.0), though the store showed 11.2605.81.0 until it was added on 6 November.

Security researcher Brian Vitko indicated the advisory’s later wording aligns more with a local, user-interaction attack, such as social engineering to load a crafted file, rather than a network-based trigger. The article attributes these shifts to Microsoft FAQ wording rather than a substantive change in the vulnerability itself.