Microsoft Paint: the CVE-2026-83844 fix skips Windows Update, you need the Microsoft Store

Microsoft has fixed CVE-2026-83844, a remote code execution flaw in Paint, but the patch only ships through the Microsoft Store, not Windows Update. It affects almost any small business running Windows. This week, check that Paint is on version 11.2609.401.0 or later for every user account and for the provisioned copy.

Key facts

• CVE-2026-83844 is an out-of-bounds read in Windows Paint that could allow code execution over a network. Microsoft rates it Important, with a CVSS of 8.1, according to The Hacker News.
• The fixed version is 11.2609.401.0. It is only distributed through the Microsoft Store.
• Microsoft disclosed the flaw on 13 October. At that point it was not listed as exploited or publicly disclosed, and it was not in CISA's Known Exploited Vulnerabilities catalogue when The Hacker News checked.
• The CVE record lists Paint as affected only below 11.2605.91.0, a version older than the fixed one.
• The advisory offers no mitigation or workaround.

Am I affected if Windows Update is up to date?

Yes. That is exactly the problem. If your company has Windows 11 machines, or Windows 10 with the Store version of Paint, an up-to-date Windows Update guarantees nothing. The fix travels through a different channel.

According to the advisory cited by The Hacker News, an attack would involve sending a crafted packet to an affected service over the network, with no sign-in and no user interaction. The advisory does not name that service. Microsoft adds that an attack requires in-depth knowledge of the target system.

There is another wrinkle. The fixed version has not been available everywhere at the same time. Early that week, Brian Vitko of RFF checked six countries and found the newest version in the Store was 11.2605.81.0, without the fix. Later, The Hacker News saw 11.2609.401.0 as the newest in the ten countries it checked.

Why might my scanner say it is fixed?

Because the CVE record and Microsoft's advisory don't match. The record marks Paint as affected only below 11.2605.91.0. A scanner relying on that record would clear any device from that version upwards, even if it is still below 11.2609.401.0, the version that actually fixes the flaw.

Then there is how Paint is installed. It is installed separately for each user account, and Windows may also keep a provisioned copy for new users. If you only check the signed-in account, older copies can slip through.

What to do today

1. Ask whoever runs your IT to check the Paint version for every user account and for the provisioned copy on each machine. The Hacker News includes two PowerShell commands, to run as administrator: one lists each user's copy and the other the provisioned one.
2. Update anything below 11.2609.401.0. You can do it from the Store or let Store automatic updates install the fixed version.
3. If you manage devices with Intune or another tool, run the Store app update scan to apply it to many machines at once.
4. Don't close the issue just because your vulnerability scanner gives the all-clear. Check the actual version number.
5. If nobody uses Paint, consider removing it for all users and from the provisioned copy. That is what the researcher suggested, though he did not test that step, so try it on one machine first.

What it means for a small business

This is not an emergency. There is no reported active exploitation and the attack requires good knowledge of the system. No need to stop anyone's work or call a crisis meeting.

What this case does show is less comfortable: many small businesses assume a green Windows Update means they are patched. Apps Microsoft ships through the Store, such as Paint, update through a different route, and if that route is switched off or nobody watches it, the device falls behind without any alarm going off. If your scanner also reads an outdated CVE record, the report will tell you everything is fine.

Our recommendation: close this flaw this week and use it to answer one concrete question. Who checks Store updates on your devices, and how do you know? If the answer is "nobody" or "I assume it happens on its own", you have a gap that goes beyond Paint. If you want help sorting out how your devices get patched, that is part of our cybersecurity work for small businesses.

Frequently asked questions

Is running Windows Update enough?

No. The CVE-2026-83844 fix only arrives through the Microsoft Store. You need Paint on version 11.2609.401.0 or later.

Is it being exploited?

Not as far as is known. It was not listed as exploited when Microsoft disclosed it, and it was not in CISA's catalogue when The Hacker News checked.

Is there a mitigation if I can't update?

The advisory offers none. The alternative the researcher suggested is uninstalling Paint if nobody needs it, though he did not test it.

Sources

• The Hacker News – Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It