Microsoft has made a security fix available through the Microsoft Store for CVE-2026-83844, a remote code execution vulnerability affecting Windows Paint. Unlike security patches delivered through regular Windows updates, the fix for this issue is distributed through an update to the Paint application itself. The fixed version identified in Microsoft’s security advisory is 11.2609.401.0. According to The Hacker News, this was the newest Paint build available in all ten countries it checked on November 6, 2026. The vulnerability involves an out-of-bounds read, a type of software flaw that can allow a program to access memory outside the intended boundaries. Microsoft describes the issue as one that could enable an unauthorised attacker to execute code over a network and has assigned it an Important severity rating, with a CVSS score of 8.1. The company published information about the vulnerability on October 13, 2026, and stated at the time that it was not aware of public disclosure or exploitation. The issue is particularly relevant for Windows administrators because installing the latest Windows operating system updates alone may not ensure that Paint has received the security fix. Users and IT teams therefore need to check the application version separately and ensure that the Microsoft Store has delivered the updated build.
The availability of the fix follows earlier findings by Brian Vitko of RFF, a company that develops device-management software. Earlier in the week, Vitko examined the Paint versions offered through the Microsoft Store in six countries and found that version 11.2605.81.0 was the newest available in each location. That build did not contain the fix identified by Microsoft. His findings raised concerns about the difference between the version Microsoft had designated as fixed and the version that users could actually obtain through the Store. However, Vitko subsequently reported that his test virtual machine had automatically moved to version 11.2609.401.0 through the Store’s automatic update process. The Hacker News also checked Store availability across ten countries on November 6 and found the fixed build to be the newest version listed in each market. These observations indicate that the updated release had become available more broadly, although they do not establish how quickly every Windows computer will receive it. The speed of deployment may vary between devices, and the experience of one test machine does not confirm that all systems have updated. Organisations managing multiple Windows endpoints may therefore need to verify the installed Paint version across their devices rather than assuming that automatic updates have completed successfully.
There is also a discrepancy between Microsoft’s security advisory and the version information contained in the public CVE record. Microsoft’s advisory identifies Paint version 11.2609.401.0 as the fixed release, while the CVE record and the National Vulnerability Database list versions below 11.2605.91.0 as affected. Based on the public CVE record, automated vulnerability scanners could consequently classify versions from 11.2605.91.0 onward as no longer affected, even though Microsoft’s advisory names a later build as the fixed version. A Paint installation running version 11.2609.401.0 or later meets both version thresholds. The version information has also changed over time. A Microsoft Q&A forum discussion indicates that the advisory listed 11.2605.91.0 as the fixed version as recently as the previous week, before the newer 11.2609.401.0 designation appeared. The advisory’s revision history, however, reportedly continues to show its original October 13 entry without a separate note explaining the version change. This difference is important for security teams responsible for vulnerability assessment and compliance reporting, as relying on only one version threshold could produce inconsistent results. Administrators should use Microsoft’s latest advisory as the primary reference for the fixed build while remaining aware of the discrepancy in the public vulnerability records. The issue also requires checking all Paint installations on a computer because the application can be installed separately for individual Windows user accounts, while Windows may maintain a provisioned copy for newly created accounts.
To help administrators identify potentially outdated installations, Vitko’s technical write-up provides PowerShell commands that can list Paint versions installed across user accounts and identify the provisioned application copy. Running these checks in an administrator PowerShell session can help organisations establish whether every relevant installation has reached the required version. For any copy below 11.2609.401.0, the recommended step is to update Paint through the Microsoft Store or allow its automatic update mechanism to install the fixed release. Organisations using Microsoft Intune and other device-management platforms can also use Store application update scans to manage updates across multiple computers. Administrators should repeat the version checks after the update process to confirm that all installed and provisioned copies show version 11.2609.401.0 or later. Microsoft’s advisory does not list a workaround or mitigation for the vulnerability. Before the fixed build became available through the Store, Vitko suggested removing Paint from systems where it was not required, including individual user installations and the provisioned copy, although he noted that he had not tested that removal procedure. Microsoft describes the attack as involving a specially crafted network packet sent to an affected service, without identifying the service in the advisory. The reported attack conditions do not require authentication or user interaction, although Microsoft indicates that successful exploitation requires a deep understanding of the target system. At the time of The Hacker News’ report, CVE-2026-83844 was not listed in the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalogue. The available information therefore points to a vulnerability requiring attention from Windows users and administrators, particularly those managing multiple devices, with verification of the Paint application version remaining an important part of the update process.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
