Windows Paint’s code-execution fix ships only through the Microsoft Store. Check every user’s copy

Microsoft disclosed a code-execution bug in Windows Paint on October 13, but the fixed build only showed up in the Microsoft Store this week. Paint is a Store app, so Windows Update and your monthly patch run never deliver it.

The Hacker News found build 11.2609.401.0 offered in all ten countries it checked on November 6. The catch is that scanners reading the CVE record may already call older builds fixed.

Windows Update will not fix Paint. Push the Store update and check every user’s copy for 11.2609.401.0.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

Paint’s code-execution fix finally reached the Store

CVE-2026-83844 is an out-of-bounds read in Windows Paint that Microsoft rates Important, CVSS 8.1. Microsoft said it was not exploited or publicly disclosed when it published the advisory on October 13.

Microsoft’s advisory now names 11.2609.401.0 as the fixed build. The CVE record and its NVD entry still list Paint as affected only below 11.2605.91.0, and the advisory’s revision history shows no note about the change.

• Fixed: Paint 11.2609.401.0 or later, delivered through the Microsoft Store only.
• No workaround or mitigation is listed in the advisory.
• Earlier in the week, Brian Vitko of RFF found 11.2605.81.0, a build without the fix, as the newest Store build in six countries.

Every Windows PC, one copy per user

Paint is on nearly every Windows 10 and 11 desktop, and Store apps install separately for each user account. Windows can also keep a provisioned copy that is installed for every new user. Checking only the signed-in user misses older copies.

Vulnerability scanners that read the CVE record will mark anything from 11.2605.91.0 up as fixed. A PC on 11.2605.91.0 passes that scan and still lacks the build Microsoft now names.

Push the Store update and check all copies

• Run the Store app update scan from Intune or your device-management tool, or let Store auto-update install 11.2609.401.0.
• In an admin PowerShell, list every user’s copy: Get-AppxPackage -AllUsers -Name Microsoft.Paint, and the provisioned copy: Get-AppxProvisionedPackage -Online | Where-Object DisplayName -eq 'Microsoft.Paint'.
• Treat anything below 11.2609.401.0 as unpatched, whatever the scanner says.
• Where nobody needs Paint, consider removing it for all users and from the provisioned image (Vitko suggested this but did not test it).

Details

• CVE-2026-83844: Windows Paint out-of-bounds read leading to code execution. Important, CVSS 8.1. Published October 13, 2026.
• Fixed build (per Microsoft advisory): 11.2609.401.0. CVE record / NVD still show affected below 11.2605.91.0.
• Delivery: Microsoft Store only. Not exploited or publicly disclosed at publication; not on CISA KEV as of November 6.

Hunt / verify

• Run the two PowerShell commands above across your fleet and export versions per user SID.
• Compare scanner results against the 11.2609.401.0 floor and fix the rule if it uses the CVE record’s 11.2605.91.0 range.
• Check that Store auto-update is not disabled by policy on managed PCs.

Source: Microsoft advisory CVE-2026-83844; The Hacker News: Paint fix in the Store

Sources

• Microsoft Security Response Center: CVE-2026-83844 Windows Paint
• The Hacker News: Microsoft Paint RCE Fix Now Available, but Windows Update Won’t Deliver It
• CVE.org: CVE-2026-83844
• NVD: CVE-2026-83844

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].