Microsoft patches Paint RCE flaw but delivers fix through Store only

Microsoft fixed CVE-2026-83844, a remote code execution vulnerability in Windows Paint, through the Microsoft Store on October 13, 2026, rather than through Windows Update.

The vulnerability, tracked as CVE-2026-83844, is an out-of-bounds read flaw in Windows Paint that allows network-based code execution without sign-in or user assistance. An out-of-bounds read is a memory error in which an application reads data past the end of a buffer. Microsoft rates it Important with a CVSS score of 8.1 and said successful exploitation requires a deep understanding of the target system, rating attack complexity as high. The company credited an anonymous researcher with flagging the flaw through its official disclosure channel.

Microsoft said on October 13, 2026 that no known exploitation or public disclosure of the flaw existed when it published the vulnerability. CISA’s Known Exploited Vulnerabilities catalog did not list the flaw on November 6, 2026, and had last been updated earlier that week. No exploitation has been reported.

The fix arrives as Paint build 11.2609.401.0, but Windows Update, WSUS, Intune update rings and Autopatch do not service Paint, so Store-only delivery leaves many managed endpoints without the fix by default. Updates for in-box Store apps travel a separate track from Windows Update and WSUS, leaving traditional OS patching blind to Paint. Enterprises that depend only on Windows Update face longer exposure windows and must check each user account’s Paint version manually.

Microsoft’s security advisory names 11.2609.401.0 as the fixed Paint build. Reporting by The Hacker News and InfoSec Monkey indicates the advisory originally named 11.2605.91.0 as the fix before changing to 11.2609.401.0, and the advisory revision history shows only the October 13 entry with no note about the change. The CVE record and the NVD entry list Paint as affected only below build 11.2605.91.0, conflicting with the advisory’s fixed build, a versioning mismatch that can make scanners mark vulnerable builds as fixed. Aviatrix.ai describes CVE-2026-83844 as critical while Microsoft rates it Important.

Because Paint is not a listening service, analysts at ThreatDefence and Joho no Todai view a malicious image delivered by download, attachment or sharing as the likely route into the application. Defender for Endpoint advanced hunting can watch for Paint spawning shells or script hosts, though no exploitation has been reported.

Windows installs Paint separately for each user account on a PC and can keep a provisioned copy of Paint that it installs for each new user. Reviewing just the signed-in user account can overlook earlier Paint versions under other accounts. On shared and multi-user PCs, one user can run the fixed build while the next logon still uses an old build, and fresh profiles built from an old image inherit the provisioned Paint version and wait for the Store to catch up.

Admins can list every user’s copy of Paint with Get-AppxPackage -AllUsers -Name Microsoft.Paint in an administrator PowerShell window, a command from Vitko’s write-up. They can list the provisioned copy with Get-AppxProvisionedPackage -Online filtered for Microsoft.Paint.

Admins can update Paint through the Microsoft Store Downloads page or run winget upgrade with the msstore source in the user’s session; the winget command ID is 9PCFS5B6T72H. MSRC notes a restart may be needed after installing the Paint update. In Intune, admins can add Paint as a Microsoft Store app, search for 9PCFS5B6T72H and assign it as Required.

Devices managed by organizations that block the Store or Store automatic updates using Group Policy or MDM never receive the Paint fix. Testers reported Paint parked on build 11.2603.251.0 with no update offered even with the Store working, and Brian Vitko of RFF’s test virtual machine later reached the fixed build through Store auto-update, though how quickly other PCs will get it is unclear. The Hacker News found 11.2609.401.0 was the newest Paint build in all ten countries it checked on November 6, 2026.

Brian Vitko of RFF found the Store offered Paint build 11.2605.81.0 without the fix in six countries earlier this week. Before the fix reached the Store, Vitko suggested removing Paint where nobody needs it, including from the provisioned copy, though he did not test the removal step.

Microsoft’s advisory lists no workaround or mitigation for the flaw. CrowdStrike’s October Patch Tuesday analysis flagged the same app-update trap for the Raw Image Extension, a precedent for Store-serviced app patch gaps, and Malware.News says OS patch compliance does not prove the Paint package was updated, a warning that compliance dashboards can be misleading.