A fix for a remote code execution flaw in Microsoft Paint is now in the Microsoft Store, but Windows Update will not deliver it, so a PC can report itself fully patched while Paint stays vulnerable. The flaw, CVE-2026-83844, is an out-of-bounds read Microsoft rates Important, with a CVSS score of 8.1. The fixed build is 11.2609.401.0.

Paint is a Store app, serviced separately from Windows itself. The Hacker News checked the Store in ten countries on 6 November and found the fixed build newest in each. Earlier in the week Brian Vitko of RFF found the newest build in six countries was 11.2605.81.0, without the fix. His test machine has since picked it up, but how quickly others follow is not yet clear.

Two version numbers cause confusion

Microsoft's advisory names 11.2609.401.0 as the fixed build, while the CVE record still lists Paint as affected only below 11.2605.91.0. A scanner reading the CVE record alone could treat any build from 11.2605.91.0 up as fixed. The safe check is 11.2609.401.0 or later.

Check every copy, including provisioned ones

Paint is installed separately for each user account, and Windows can also keep a provisioned copy for new profiles, so checking only the signed-in account can miss older ones. Administrators can list every user's copy with PowerShell, check the provisioned package the same way, and update through the Store. Microsoft lists no workaround.

Microsoft says the flaw was not known to be exploited at publication on 13 October, and it was not in CISA's Known Exploited Vulnerabilities catalog as of 6 November. The advisory says an attacker could send a specially crafted packet to an affected service over the network, with no sign-in, but it does not name the service or confirm that opening a crafted image triggers the flaw.