Paint Store Fix for CVE-2026-83844 Is Live

The fixed build of Microsoft Paint for CVE-2026-83844 is finally in the Microsoft Store. Windows Update will not install it — you have to update the Paint app (or wait for Store auto-update) and confirm every user account on the PC is on 11.2609.401.0 or later.

What happened

Microsoft published the flaw on October 13 as an out-of-bounds read in Paint that can lead to remote code execution. The company rates it Important with a CVSS 8.1 score, and says an unauthenticated attacker could trigger it by sending a specially crafted packet to an affected service over the network — no sign-in and no click required, but with high attack complexity. See the MSRC advisory for CVE-2026-83844.

Paint is a Microsoft Store app, so the patch does not ride along with Patch Tuesday. For weeks the Store’s newest package stayed on 11.2605.81.0 (or older, depending on the PC) while Microsoft’s security data pointed at 11.2609.401.0. Windows Latest still had Paint on 11.2603.251.0 with Store auto-updates on; Brian Vitko’s RFF write-up confirmed the same gap across lab machines and Store catalog checks in the US, UK, Germany, Australia, India and Singapore.

On November 6, that changed. RFF re-queried the Store catalog around 04:14 UTC and saw 11.2609.401.0 for the US, UK and Germany; a lab VM had already picked it up through Store auto-update. The Hacker News checked ten countries the same day and found 11.2609.401.0 as the newest Paint build in each (their X post). The public CVE record still lists Paint as affected only below 11.2605.91.0, so a scanner that trusts that line alone can call a mid-build “fixed” when Microsoft’s own update table still wants 11.2609.401.0 — go by the higher number.

Why it matters

Plenty of people treat “Windows is up to date” as “every Microsoft app is patched.” Paint breaks that assumption: a patched Windows 11 PC can still run a vulnerable Store copy on one account while another account — or the provisioned package that seeds new profiles — stays behind. Shared family PCs and fleets that block the Store are the easy miss. There is no known exploitation in the wild as of The Hacker News’ check, and this CVE is not on CISA’s KEV list. That buys calm, not a free pass — Microsoft marks it “Customer Action Required,” with no workaround besides updating or removing Paint.

What to do

• Check every copy: open an elevated PowerShell and run Get-AppxPackage -AllUsers -Name Microsoft.Paint | Select-Object Version, then Get-AppxProvisionedPackage -Online | Where-Object DisplayName -eq 'Microsoft.Paint' | Select-Object Version. Anything below 11.2609.401.0 needs a Store update. Dropping -AllUsers only shows your own account.
• Update via the Store: open Microsoft Store → Library → Get updates, or open Paint’s Store listing and update. Leave Store auto-updates on. On managed PCs, trigger the Store app update scan from Intune / your MDM rather than waiting for Windows Update.
• Re-check after update: run both commands again so the provisioned copy and every user profile show 11.2609.401.0 or newer. Do not trust a vulnerability scanner that stops at 11.2605.91.0.
• If you never use Paint: you can uninstall it per user and from the provisioned package until every machine is verified, then reinstall from the Store later. RFF suggested that path before the fixed build shipped; try it on one PC first.
• Related reading: if Windows Update itself is stuck while you chase Store apps, see Windows Update stuck fixes. Store vs OS patching is the same surprise class as the Alpine OpenSSH password bypass — the OS channel is not always the app channel.

My take

This is the kind of bug that only bites you if you assume Patch Tuesday covers inbox apps. I would treat Paint like any other Store app that handles untrusted input: check the version once, force a Store update, and spot-check shared PCs (parents’ laptops, office hotdesks, school lab images). Indian home users on shared Windows accounts are especially easy to miss — update under each signed-in profile, not just the admin one. I would not panic-uninstall Paint on a machine that already shows 11.2609.401.0; I also would not ignore a scanner alert that still says vulnerable until PowerShell agrees. And if your organisation blocks the Microsoft Store entirely, this CVE is your reminder that “no Store” also means “no Paint security updates” unless you ship the package another way.