CVE-2026-83844 — a remote code execution flaw in Microsoft Paint — has been fixed, but only through the Microsoft Store, not through Windows updates, and the distribution details leave room for confusion and uneven coverage across accounts and devices.
How Microsoft issued the fix and what the advisory says
Microsoft published an advisory on October 13 naming Paint's remote-code-execution vulnerability CVE-2026-83844 and rating it Important with a CVSS score of 8.1. The advisory says the flaw is an out-of-bounds read that "could let an attacker run code over a network," and that a successful attack would "require a deep understanding of the target system." It also states the attack would require no sign-in and no user assistance and could be triggered by "a specially crafted packet to an affected service over the network." Microsoft said the flaw was not known to be exploited or publicly disclosed when the advisory was published.
Microsoft Store-only delivery: what that means
Unlike many Windows updates, the Paint fix is being delivered only through the Microsoft Store. The advisory and subsequent reporting make clear that Windows Update will not push this corrected Paint build; administrators and users must get the updated Paint package from the Store or rely on the Store's automatic updating. Device-management tools that scan for and install Store app updates — for example Intune, as named in testing notes — can perform the update across many PCs.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleWhich build numbers actually count as fixed
Microsoft's security advisory names build 11.2609.401.0 as the fixed Paint build. But the public CVE record and the NVD entry still list Paint as affected for versions below 11.2605.91.0. That mismatch means a scanner that reads the CVE record would treat any build from 11.2605.91.0 and later as fixed, while the advisory itself identifies 11.2609.401.0 as the corrected release. Earlier last-week guidance in a Microsoft Q&A forum showed 11.2605.91.0 as the fixed build; the advisory's revision history visible at the time shows only the October 13 entry, with no explicit note about the later build-number change.
Marketplace testing: what The Hacker News and Brian Vitko observed
The Hacker News reported that the fixed build, 11.2609.401.0, was the newest Paint build in all ten countries it checked on the day of reporting. Brian Vitko of RFF, a device-management software maker, ran his own checks in six countries earlier in the week and found the newest Store-offered build in each was 11.2605.81.0 — a build that does not contain the fix. Vitko later reported that a test virtual machine he controls moved to the fixed build on its own through the Store's auto-update mechanism; that was one machine, and how quickly other PCs will receive 11.2609.401.0 remains unclear.
How to check every copy of Paint and install the fix
Because Store apps are installed per user and because Windows can keep a provisioned copy that is installed for new user accounts, checking only the signed-in account can miss older copies of Paint. Vitko published two PowerShell commands to run in an elevated shell to list every user's package and the provisioned package (as shown below):
Get-AppxPackage -AllUsers -Name Microsoft.Paint | Select-Object Version, @{{ n = 'Users'; e = {{ $_.PackageUserInformation.UserSecurityId.Username -join ', ' }} }}
Get-AppxProvisionedPackage -Online | Where-Object DisplayName -eq 'Microsoft.Paint' | Select-Object Version
For any copy that is below 11.2609.401.0, the available steps are to update Paint through the Microsoft Store or allow the Store auto-update to install the fixed build. In managed environments, Intune and other device-management tools that perform Store app update scans can push the corrected build broadly. After updating, run the two PowerShell checks again to confirm every per-user and provisioned copy shows 11.2609.401.0 or later. Microsoft lists no workaround or mitigation in the advisory; Vitko suggested removing Paint entirely where it is not needed for any user and from the provisioned image, though he did not test that removal step.
What device managers, security teams, and end users should watch
- Device managers and enterprise security teams: confirm the Store-distributed build 11.2609.401.0 has been applied to all per-user and provisioned copies. Use the provided PowerShell checks and, where available, leverage Intune or similar tooling to scan and install Store updates at scale.
- Security operations and vulnerability scanners: be aware of the discrepancy between the advisory (11.2609.401.0) and the public CVE/NVD entries (which treat builds from 11.2605.91.0 and later as fixed). Scanners that rely solely on the CVE record may report different results than checks that look for the advisory's specific build number.
- End users: if Paint is used on your account, check the Microsoft Store for an update or allow Store auto-update to run; if Paint is unused, administrators may consider removing per-user and provisioned copies where practical.
The fix for a high-scoring remote-code-execution bug now exists in the Store, but the mismatch between advisory and CVE build numbers, the per-user and provisioned-installation model for Store apps, and staggered rollout across countries mean the technical and operational work of verifying remediation still rests with IT teams and administrators. Which build number enterprises and scanners will treat as authoritative — 11.2605.91.0 per the CVE/NVD or 11.2609.401.0 per Microsoft's advisory — will determine how cleanly that verification proceeds.
https://thehackernews.com/2026/11/microsoft-paint-rce-fix-now-available.html
