Windows Paint Security Fix Is Out, but Windows Update Will Not Deliver It

A fix is now available for CVE-2026-83844, a remote code execution flaw in Windows Paint. The catch is that Paint receives the fix only through a Microsoft Store update, not through Windows updates. The fixed build is 11.2609.401.0, which The Hacker News found to be the newest Paint build in all ten countries it checked. The flaw is an out-of-bounds read that could let an attacker run code over a network. Microsoft rates it Important with a CVSS score of 8.1, and says a successful attack requires a deep understanding of the target system. It was not known to be exploited or publicly disclosed when Microsoft published it on October 13.

There is some confusion about the fixed version. Microsoft's advisory names 11.2609.401.0, but the CVE record and the NVD entry still list Paint as affected only below 11.2605.91.0. A scanner that relies on the CVE record would treat builds from 11.2605.91.0 upward as fixed. Earlier this week, researcher Brian Vitko found the Store offering only build 11.2605.81.0, which lacks the fix, in six countries. His test machine has since moved to the fixed build through auto-update, though it is unclear how quickly other PCs will follow.

Paint is installed separately for each user account, and Windows may also keep a provisioned copy for new users. Checking only the signed-in account can miss older copies, so administrators should check every user's copy and the provisioned one.