Microsoft released a fix for the Windows Paint remote code execution flaw CVE-2026-83844 on October 13, 2026. But on November 5, Windows Latest reported that some users still couldn’t get the patched version through the Microsoft Store.
What Happened
Microsoft rates the Paint remote code execution flaw Important, with a CVSS score of 8.1. According to Microsoft’s advisory, an unauthenticated attacker could send a specially crafted packet to an affected service over the network, exploiting an out-of-bounds read in Paint to execute code. Microsoft says no authentication or user interaction is required.
Microsoft rates the attack high in complexity and exploitation less likely, and its advisory lists the flaw as neither publicly disclosed nor exploited. No attacks in the wild have been reported so far, though that doesn’t guarantee none have occurred undetected.
The update problem is a separate report. Microsoft’s Security Update Guide lists the fix as a Microsoft Store app update with fixed build 11.2609.401.0. On November 5, Windows Latest said its author found no Paint update in the Store despite automatic updates being on, and that some IT admins reported the same. The report doesn’t say why or how many users are affected.
How It Stacks Up
The two available sources give different version numbers:
| Source | Version statement | What readers can conclude |
|---|---|---|
| Microsoft Security Update Guide | Lists the Store app security update with fixed build 11.2609.401.0 | This is Microsoft’s own patched-build number, also cited by Windows Latest. |
| NVD’s CVE record | Lists affected Paint versions as below 11.2605.91.0 | This is a different boundary, and neither record explains the gap. |
If your Paint version falls between those numbers, these records don’t settle its status.
A fully updated Windows installation doesn’t necessarily settle it, either, because Microsoft lists the fix as a Microsoft Store app update rather than a Windows update package.
Checking your Paint app’s version number directly is a more reliable way to confirm the fix than checking Windows Update status alone. Windows Latest suggests opening PowerShell and running Get-AppxPackage -Name Microsoft.Paint | Select-Object Name, Version. A version of 11.2609.401.0 or newer matches Microsoft’s fixed build.
The Reaction
Reaction is still forming. The supplied social research found little or no relevant discussion on X and no matching Hacker News story. It supplied no Reddit posts. For now, the Store report and official vulnerability records offer the useful evidence.
Our Take
Verdict: Update Paint through the Microsoft Store, then check its installed version against Microsoft’s fixed build, 11.2609.401.0. If the Store still offers an older build, install the newest update it does offer and avoid using Paint where practical while you wait.
Microsoft’s update guide lists only the Store app update as the fix, with no separate download or workaround. Unofficial third-party Paint installers aren’t a safe substitute.
The flaw deserves attention: Microsoft describes remote code execution with no user action. Its high attack complexity and less likely exploitation rating argue against panic. But the version gap and reported Store problem mean you shouldn’t assume Paint is patched.
