# Microsoft Paint Flaw CVE-2026-83844: Fix Is in Store, Not Windows Update

- URL: https://usa-24.com/microsoft-paint-cve-2026-83844-fix/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-11-06T17:49:36.210Z
- Updated: 2026-11-06T17:49:36.218Z
- Topics: Microsoft Paint, Windows 11, Remote Code Execution, Microsoft Store, Patch Management, Vulnerabilities

> Microsoft's fix for a network-reachable Paint flaw ships through the Microsoft Store, not Windows Update, so many Windows 11 PCs may stay exposed. Here is the build to check.

## Key takeaways

- Microsoft's fix for CVE-2026-83844 is delivered through the Microsoft Store, not Windows Update.
- The Hacker News found Paint build 11.2609.401.0 to be the newest build in all ten countries it checked on November 6.
- Microsoft rates the flaw Important, with a CVSS 3.1 base score of 8.1 and high attack complexity.
- The CVE record still lists 11.2605.91.0 as the affected boundary, which conflicts with the build the Store now serves.
- The flaw is not in CISA's Known Exploited Vulnerabilities catalog, and no exploitation had been flagged as of these reports.

Microsoft has patched a network-reachable remote code execution flaw in Microsoft Paint, tracked as CVE-2026-83844, but many administrators will not receive the fix through Windows Update. [The Hacker News](https://thehackernews.com/2026/11/microsoft-paint-rce-fix-now-available.html) reported that the corrected app is delivered through the Microsoft Store, a separate track from the cumulative updates most Windows 11 PCs install automatically. That gap is the real story. The fix exists, but the usual update path may leave devices running a vulnerable version.

The immediate problem is a gap between a published fix and the version devices actually run, not a wave of attacks. The flaw is not in CISA's Known Exploited Vulnerabilities catalog, and Microsoft did not flag it as exploited or publicly disclosed when the advisory was published on October 13, 2026.

## What the flaw allows and how Microsoft rates it

Microsoft describes CVE-2026-83844 as an out-of-bounds read in Windows Paint that can let an unauthenticated attacker run code over a network. The company rates it Important, with a CVSS 3.1 base score of 8.1 and high attack complexity, according to [Brandefense](https://brandefense.io/security-news/windows-paint-rce-cve-2026-83844/). Brandefense also reported a temporal score of 7.1 per the Microsoft Security Response Center.

Microsoft says exploitation is less likely because it requires detailed knowledge of the target system. The company credited an anonymous researcher who reported the flaw through its vulnerability disclosure channel, according to [The420.in](https://the420.in/microsoft-paint-remote-code-execution-vulnerability-patch/).

The Hacker News quoted the advisory as warning that an attacker could exploit the flaw by sending "a specially crafted packet to an affected service over the network." The advisory does not name that service, and that omission sits at the center of the disagreement about how the bug works.

## Microsoft Paint CVE-2026-83844 fix: which build to install

The fixed build is 11.2609.401.0, offered in the Microsoft Store. The Hacker News said it was the newest Paint build in all ten countries it checked on November 6. Earlier in the week, a device-management vendor called RFF checked the Store in six countries and reported confusion over which build was current.

The confusion has a documentary source. Microsoft's guide initially named 11.2605.91.0 as the fixed release, but the CVE record still lists Paint as affected only below that version, according to [Techzine Global](https://www.techzine.eu/news/security/145581/paint-vulnerability-allows-rce-patch-is-hard-to-find/). The two numbers point in different directions, as the table below shows.

| Build | What the reporting shows |
|---|---|
| 11.2605.91.0 | Named as the fixed release in Microsoft's guide at first; still the boundary in the CVE record |
| 11.2609.401.0 | Newest Paint build in the Microsoft Store across all ten countries The Hacker News checked on November 6 |

For administrators, the practical target is 11.2609.401.0, the build the Store is serving now. Treating the older number as sufficient because it appears in the CVE record is the mistake to avoid.

## Why Windows Update may not deliver the fix

Paint on Windows 11 is a Store-delivered app, so its security fixes can arrive on a different track from the Windows cumulative updates that most people and most managed fleets watch. That mismatch is the root of the delivery problem, and it explains why security outlets focused on the gap this week.

A patch report built only on Windows Update can show a machine as current while Paint is still behind. Consumers who assume automatic Windows updates cover everything are the group most likely to be caught off guard, because they may never open the Store. Administrators face a similar blind spot if their inventory tools track operating system builds but not app versions.

This is not the first time a patch on paper failed to reach devices. USA 24 recently reported on the [Zyxel GS1900 zero-day that bypassed a June patch on nearly 1,000 switches](https://usa-24.com/zyxel-gs1900-zero-day-patch-bypass/). That failure was different, but the lesson is the same: a published fix protects no one until it lands on the device.

## Is the Paint attack truly no-click?

Outlets disagree on how the bug is triggered. [Cybernews](https://cybernews.com/security/microsoft-paint-cve-2026-83844-windows-vulnerability/), [Neowin](https://www.neowin.net/news/microsoft-paint-cve-2026-83844-lets-hackers-hack-windows-11-pcs-over-internet/) and [Cybersecurity News](https://cybersecuritynews.com/windows-paint-rce-vulnerability/) describe it as a no-click bug. [SentinelOne](https://www.sentinelone.com/vulnerability-database/cve-2026-83844/) says a victim must process a crafted image file.

[Cryptika](https://www.cryptika.com/critical-windows-paint-vulnerability-enables-remote-code-execution-attacks/) adds a caution: Microsoft's advisory does not name the service or port, so claims that malicious images alone can trigger the bug remain unconfirmed.

That difference changes how you defend. If a no-click path exists, simply receiving or previewing content could be enough. If the attack requires a victim to open a crafted file, avoiding unknown images removes most of the risk. Until Microsoft clarifies, the cautious reading is the no-click one, and the industry treats such bugs with urgency, as in [Google's patch for a critical Android flaw that needs no tap or click](https://usa-24.com/android-security-update-zero-click-flaw/).

Limit exposure now by avoiding unknown image files from email, web downloads and network shares. This is general hygiene, and SentinelOne's guidance supports it.

## How to check and update Paint today

- Open the Microsoft Store on the PC, select your Library, and choose Get updates.
- Confirm that Paint is version 11.2609.401.0 or newer. If it is older, let the update finish and check again.
- Do not assume Windows Update installed the fix. Check the app itself, as the practical guidance from Cybernews and The420.in recommends.
- Administrators should verify the build on every managed device, because Store updates may not reach managed machines on the same schedule as Windows patches.
- Until the update is confirmed, avoid opening unknown image files from email, downloads or shares.

Read Microsoft's Security Update Guide entry for CVE-2026-83844 directly before relying on any build number. This report draws on outlets quoting Microsoft's advisory, and Microsoft's own record is the authoritative source.

## What to watch next

Several questions remain open. Microsoft's advisory does not name the affected network service. Outlets still disagree on whether the attack needs a click. The CVE record still lists the older build as the boundary, and it is unclear whether Microsoft has corrected it. Microsoft and CISA had not flagged the flaw as exploited as of these reports.

Watch three signals: whether CISA adds the flaw to its catalog, whether Microsoft revises the CVE record to match the Store build, and whether administrators report devices stuck on older Paint versions. USA 24 has also covered a separate [emergency OpenSSH fix for Alpine Linux servers](https://usa-24.com/openssh-emergency-fix-alpine-linux/), where the same rule applies: confirm the version on the machine rather than assume it.

Paint's update path is now part of routine patch checks on Windows 11. If Microsoft aligns the CVE record with the Store build, the confusion should fade. If it does not, administrators will need to check Paint by hand until the record is clear.

## Frequently asked questions

### Is Microsoft Paint safe to use after CVE-2026-83844?

Update Paint to build 11.2609.401.0 or newer through the Microsoft Store, since that is where Microsoft's fix is delivered. Microsoft rates the flaw Important with a CVSS 3.1 base score of 8.1. Until the update is confirmed, avoid opening unknown image files from email, downloads and shares.

### Why doesn't Windows Update install the Paint fix?

Paint on Windows 11 is a Store-delivered app, so its security fixes can arrive on a different track from Windows cumulative updates. The Hacker News reported that Windows Update does not deliver the fix. Users and administrators should check the app version directly.

### Which Paint version fixes CVE-2026-83844?

The Hacker News reported that build 11.2609.401.0 was the newest Paint build in the Microsoft Store in all ten countries it checked on November 6. The CVE record still lists 11.2605.91.0 as the affected boundary, which has caused confusion.

### Is CVE-2026-83844 being exploited in the wild?

As of these reports, Microsoft and CISA had not flagged the flaw as exploited or publicly disclosed. It is not in CISA's Known Exploited Vulnerabilities catalog. Administrators should still patch quickly because the fix is easy to miss.

## Sources

1. [Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It — The Hacker News](https://thehackernews.com/2026/11/microsoft-paint-rce-fix-now-available.html)
2. [Microsoft Paint flaw lets hackers take control remotely — Cybernews](https://cybernews.com/security/microsoft-paint-cve-2026-83844-windows-vulnerability/)
3. [Microsoft Paint CVE-2026-83844 lets hackers hack Windows 11 PCs over internet — Neowin](https://www.neowin.net/news/microsoft-paint-cve-2026-83844-lets-hackers-hack-windows-11-pcs-over-internet/)
4. [Windows Paint RCE: Update to 11.2609.401.0 — Brandefense](https://brandefense.io/security-news/windows-paint-rce-cve-2026-83844/)
5. [Paint vulnerability allows RCE, patch is hard to find — Techzine Global](https://www.techzine.eu/news/security/145581/paint-vulnerability-allows-rce-patch-is-hard-to-find/)
6. [CVE-2026-83844: Windows Paint RCE Vulnerability — SentinelOne](https://www.sentinelone.com/vulnerability-database/cve-2026-83844/)
7. [Microsoft Paint 0-Click Vulnerability Could Allow Hackers to Take Control of Windows PCs — Cybersecurity News](https://cybersecuritynews.com/windows-paint-rce-vulnerability/)
8. [Critical Windows Paint Vulnerability Enables Remote Code Execution Attacks — Cryptika](https://www.cryptika.com/critical-windows-paint-vulnerability-enables-remote-code-execution-attacks/)
9. [Microsoft Paint Security Flaw Allows Remote Code Execution, Patch Availability Questioned — The420.in](https://the420.in/microsoft-paint-remote-code-execution-vulnerability-patch/)