Microsoft Paint RCE flaw CVE-2026-83844 patched via Microsoft Store update

What happened

Microsoft released a fix for CVE-2026-83844 on October 13. The vulnerability is an out-of-bounds read that allows an unauthorized attacker to execute code over a network by sending a specially crafted packet to an affected service.

While Microsoft's security data identifies build 11.2609.401.0 as the fixed version, the fix has been difficult to deploy. As of early November, many regions were still seeing older builds in the Microsoft Store, such as 11.2605.81.0, which do not contain the patch. Because Paint is a Store app, standard Windows Update cycles will not deliver this fix.

Why it matters

This is a high-impact vulnerability because it requires no user interaction and no sign-in to exploit. An attacker can trigger the flaw remotely over a network. The difficulty for defenders lies in the deployment model: Store apps are installed per user and can also exist as "provisioned" copies for new profiles. A standard system-wide update check might miss these individual instances, leaving vulnerable versions of Paint active on your endpoints.

Who is affected

• Microsoft Paint versions below 11.2609.401.0

What to do now

1. Update Microsoft Paint via the Microsoft Store to version 11.2609.401.0 or later.
2. Check all user accounts for vulnerable versions using this PowerShell command: Get-AppxPackage -AllUsers -Name Microsoft.Paint | Select-Object Version, @{ n = 'Users'; e = { $_.PackageUserInformation.UserSecurityId.Username -join ', ' } }
3. Check provisioned copies using: Get-AppxProvisionedPackage -Online | Where-Object DisplayName -eq 'Microsoft.Paint' | Select-Object Version
4. Remove Paint from all users and provisioned copies if you cannot immediately verify the update: Get-AppxPackage -AllUsers -Name Microsoft.Paint | Remove-AppxPackage -AllUsers and Get-AppxProvisionedPackage -Online | Where-Object DisplayName -eq 'Microsoft.Paint' | Remove-AppxProvisionedPackage -Online

What we don't know yet

• The specific service or trigger that receives the malicious packet.
• The exact timing of when the fixed build became available in the Microsoft Store globally.