Microsoft has patched a network-reachable remote code execution flaw in Microsoft Paint, tracked as CVE-2026-83844, but many administrators will not receive the fix through Windows Update. The Hacker News reported that the corrected app is delivered through the Microsoft Store, a separate track from the cumulative updates most Windows 11 PCs install automatically. That gap is the real story. The fix exists, but the usual update path may leave devices running a vulnerable version.
The immediate problem is a gap between a published fix and the version devices actually run, not a wave of attacks. The flaw is not in CISA's Known Exploited Vulnerabilities catalog, and Microsoft did not flag it as exploited or publicly disclosed when the advisory was published on October 13, 2026.
What the flaw allows and how Microsoft rates it
Microsoft describes CVE-2026-83844 as an out-of-bounds read in Windows Paint that can let an unauthenticated attacker run code over a network. The company rates it Important, with a CVSS 3.1 base score of 8.1 and high attack complexity, according to Brandefense. Brandefense also reported a temporal score of 7.1 per the Microsoft Security Response Center.
Microsoft says exploitation is less likely because it requires detailed knowledge of the target system. The company credited an anonymous researcher who reported the flaw through its vulnerability disclosure channel, according to The420.in.
The Hacker News quoted the advisory as warning that an attacker could exploit the flaw by sending "a specially crafted packet to an affected service over the network." The advisory does not name that service, and that omission sits at the center of the disagreement about how the bug works.
Microsoft Paint CVE-2026-83844 fix: which build to install
The fixed build is 11.2609.401.0, offered in the Microsoft Store. The Hacker News said it was the newest Paint build in all ten countries it checked on November 6. Earlier in the week, a device-management vendor called RFF checked the Store in six countries and reported confusion over which build was current.
The confusion has a documentary source. Microsoft's guide initially named 11.2605.91.0 as the fixed release, but the CVE record still lists Paint as affected only below that version, according to Techzine Global. The two numbers point in different directions, as the table below shows.
| Build | What the reporting shows |
|---|---|
| 11.2605.91.0 | Named as the fixed release in Microsoft's guide at first; still the boundary in the CVE record |
| 11.2609.401.0 | Newest Paint build in the Microsoft Store across all ten countries The Hacker News checked on November 6 |
For administrators, the practical target is 11.2609.401.0, the build the Store is serving now. Treating the older number as sufficient because it appears in the CVE record is the mistake to avoid.
Why Windows Update may not deliver the fix
Paint on Windows 11 is a Store-delivered app, so its security fixes can arrive on a different track from the Windows cumulative updates that most people and most managed fleets watch. That mismatch is the root of the delivery problem, and it explains why security outlets focused on the gap this week.
A patch report built only on Windows Update can show a machine as current while Paint is still behind. Consumers who assume automatic Windows updates cover everything are the group most likely to be caught off guard, because they may never open the Store. Administrators face a similar blind spot if their inventory tools track operating system builds but not app versions.
This is not the first time a patch on paper failed to reach devices. USA 24 recently reported on the Zyxel GS1900 zero-day that bypassed a June patch on nearly 1,000 switches. That failure was different, but the lesson is the same: a published fix protects no one until it lands on the device.
Is the Paint attack truly no-click?
Outlets disagree on how the bug is triggered. Cybernews, Neowin and Cybersecurity News describe it as a no-click bug. SentinelOne says a victim must process a crafted image file.
Cryptika adds a caution: Microsoft's advisory does not name the service or port, so claims that malicious images alone can trigger the bug remain unconfirmed.
That difference changes how you defend. If a no-click path exists, simply receiving or previewing content could be enough. If the attack requires a victim to open a crafted file, avoiding unknown images removes most of the risk. Until Microsoft clarifies, the cautious reading is the no-click one, and the industry treats such bugs with urgency, as in Google's patch for a critical Android flaw that needs no tap or click.
Limit exposure now by avoiding unknown image files from email, web downloads and network shares. This is general hygiene, and SentinelOne's guidance supports it.
How to check and update Paint today
- Open the Microsoft Store on the PC, select your Library, and choose Get updates.
- Confirm that Paint is version 11.2609.401.0 or newer. If it is older, let the update finish and check again.
- Do not assume Windows Update installed the fix. Check the app itself, as the practical guidance from Cybernews and The420.in recommends.
- Administrators should verify the build on every managed device, because Store updates may not reach managed machines on the same schedule as Windows patches.
- Until the update is confirmed, avoid opening unknown image files from email, downloads or shares.
Read Microsoft's Security Update Guide entry for CVE-2026-83844 directly before relying on any build number. This report draws on outlets quoting Microsoft's advisory, and Microsoft's own record is the authoritative source.
What to watch next
Several questions remain open. Microsoft's advisory does not name the affected network service. Outlets still disagree on whether the attack needs a click. The CVE record still lists the older build as the boundary, and it is unclear whether Microsoft has corrected it. Microsoft and CISA had not flagged the flaw as exploited as of these reports.
Watch three signals: whether CISA adds the flaw to its catalog, whether Microsoft revises the CVE record to match the Store build, and whether administrators report devices stuck on older Paint versions. USA 24 has also covered a separate emergency OpenSSH fix for Alpine Linux servers, where the same rule applies: confirm the version on the machine rather than assume it.
Paint's update path is now part of routine patch checks on Windows 11. If Microsoft aligns the CVE record with the Store build, the confusion should fade. If it does not, administrators will need to check Paint by hand until the record is clear.
