Windows Paint RCE CVE-2026-83844 Is Fixed Only Through the Microsoft Store — and the CVE Data Still Lists the Wrong Fixed Build
Microsoft's fix for the CVSS 8.1 Paint remote code execution flaw CVE-2026-83844 arrives only as Store build 11.2609.401.0, not via Windows Update, while CVE and NVD records still name an older build as fixed.
Microsoft has a fix for a remote code execution flaw in Windows Paint, but it will not arrive through Windows Update. The patch for CVE-2026-83844 ships only as a Microsoft Store app update, and the version numbers that vulnerability scanners rely on still point to the wrong build. Organisations that assume Patch Tuesday covered them may have unpatched copies of Paint on every PC.
What Happened
Microsoft disclosed CVE-2026-83844 on 13 October 2026 as a remote code execution vulnerability in Paint, rated Important with a CVSS score of 8.1. At disclosure, it was not publicly known or exploited.
The fix is a new Paint build delivered through the Microsoft Store. Microsoft's advisory now names 11.2609.401.0 as the fixed build. Earlier, according to a question on Microsoft's own Q&A forum, the advisory listed 11.2605.91.0. The revision history does not mention this change.
The CVE record and the NIST National Vulnerability Database entry have not caught up. They still say Paint is affected only below 11.2605.91.0. A scanner reading them would mark 11.2605.91.0 and later as safe, even though builds between that and 11.2609.401.0 do not have the fix.
Technical Details
Microsoft describes the bug as an out-of-bounds read that can lead to code execution over a network. The advisory says an attacker could send "a specially crafted packet to an affected service over the network." It does not say which service.
The advisory gives these conditions:
- No sign-in is required.
- No user interaction is required.
- Attack complexity is high. A successful attack requires a deep understanding of the target system, which explains why the score is 8.1 and not higher.
Microsoft lists no workaround or mitigation. The only fix is the new build.
Patch Status and the Store Problem
Because Paint is a Store app, the fix only reaches a PC through Microsoft Store updates. A security researcher who tested the rollout found that the newest Paint build available in six countries was 11.2605.81.0, which does not contain the fix. In other markets, 11.2609.401.0 was available. On the researcher's test virtual machine, Store auto-update installed the fixed build without any action. How quickly other PCs receive it is unclear.
There is a second catch. Paint is installed per user, and Windows can also keep a provisioned copy that it installs for new users. If you check only the signed-in account, you can miss vulnerable copies belonging to other users or the provisioned package.
CVE-2026-83844 was not in CISA's Known Exploited Vulnerabilities catalog at the time of writing, and there are no public reports of exploitation.
Who Is Affected
- Windows PCs with Paint versions below 11.2609.401.0, for any user profile.
- Managed fleets where Store updates are disabled, deferred or blocked by policy. These will not get the fix through normal patching.
- Teams whose vulnerability management relies on NVD or CVE version ranges. These may wrongly report machines on 11.2605.91.0 or later as fixed.
What To Do Now
Check every copy of Paint on the machine, not just yours. From an elevated PowerShell prompt:
# Every installed copy of Paint, for all users
Get-AppxPackage -AllUsers -Name Microsoft.Paint | Select-Object Name, Version, PackageUserInformation
# The provisioned copy that Windows installs for new users
Get-AppxProvisionedPackage -Online | Where-Object DisplayName -eq 'Microsoft.Paint' | Select-Object DisplayName, VersionThen:
- Update any copy below 11.2609.401.0 through the Microsoft Store, or let Store auto-update install it.
- In Intune or a similar endpoint manager, trigger a Store app update scan so fleets update together.
- Run both commands again and confirm every copy reports 11.2609.401.0 or later.
- Use 11.2609.401.0 as the fixed version in your scanner rules until the CVE and NVD entries are corrected.
- Where nobody needs Paint (servers, kiosks, locked-down workstations), consider removing it for all users and from the provisioned image. The researcher who suggested this said they had not tested it, so try it on a pilot group first.
# Optional: remove Paint where it is not needed (test first)
Get-AppxPackage -AllUsers -Name Microsoft.Paint | Remove-AppxPackage -AllUsers
Get-AppxProvisionedPackage -Online | Where-Object DisplayName -eq 'Microsoft.Paint' | Remove-AppxProvisionedPackage -OnlineWhy It Matters
Over the past few years Microsoft has moved inbox apps such as Paint, Notepad and Snipping Tool to the Store. That lets it ship features faster, but it also moves their security fixes out of the Windows Update pipeline that most patch processes are built around. A CVE that appears on Patch Tuesday but is fixed through a different channel is easy to miss.
CVE-2026-83844 shows three common weaknesses in one bug: a fix delivered outside the usual channel, a fixed version that changed without notice, and public vulnerability data that has not been updated. None of these needs an attacker to be dangerous. Each just leaves the bug unpatched for longer.
The practical lesson goes beyond Paint. Include Store-delivered apps in your patch inventory, check package versions on the endpoint itself rather than relying only on what a database says, and treat "the advisory changed" as a reason to re-scan.
