Microsoft has fixed a remote code execution flaw in Windows 11 Paint, but the fix does not arrive through Windows Update. CVE-2026-83844, an out-of-bounds read (CWE-125) rated Important with a CVSS score of 8.1, is only resolved by Paint build 11.2609.401.0, distributed exclusively through the Microsoft Store.
The problem is practical: on Windows 11, Paint is a Store app, and its updates travel on a separate track from the operating system. The monthly cumulative update patches Windows, but it never touches Paint. A PC that is fully up to date through Windows Update can still be running the vulnerable app without its owner knowing.
The fixed build number changed along the way
Microsoft disclosed the flaw on October 13, 2026. At the time, the advisory named build 11.2605.91.0 as the fixed version — but that build never appeared in the public Store catalog. Researchers who queried the catalog in early November found the newest version was 11.2605.81.0, which does not contain the fix.
On November 6, Microsoft revised the advisory and began naming build 11.2609.401.0 as the fixed one. The Hacker News confirmed it was the newest Store build in ten countries it checked that day. The public CVE record and the NVD entry, however, still list Paint as affected only below 11.2605.91.0 — which can lead a scanner to call a vulnerable machine fixed. The practical rule is simple: any build below 11.2609.401.0 should be treated as vulnerable.
How to check and fix it
To update, open the Microsoft Store, go to Library and select Get updates, or let the Store's auto-update do the work. From a terminal, the command is winget upgrade --id 9PCFS5B6T72H --source msstore. Then confirm the installed version is 11.2609.401.0 or later.
Paint is installed separately for each user account on a PC, and Windows can also keep a provisioned copy that it installs for each new user. So it is worth checking every copy, not just the current account's — for example, with PowerShell as administrator: Get-AppxPackage -AllUsers -Name Microsoft.Paint | Select-Object Version.
What is known about exploitation
According to Microsoft's advisory, an attacker could exploit the flaw by sending a specially crafted packet to an affected service over the network, with no sign-in and no user interaction — but the attack would require a deep understanding of the target system. The flaw was not known to be exploited or publicly disclosed when it was published on October 13, and it was not in the U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) catalog when checked on November 6. Microsoft lists no workaround or mitigation: updating is the only defense. Classic Paint on Windows 10 is not listed as affected; only the Store app on Windows 11 is in scope.
The warning also circulated on X: on November 7, Binance co-founder Changpeng Zhao (CZ) reposted an alert about the flaw and said application software cannot protect users from operating system vulnerabilities, urging an immediate update. The flaw itself is confirmed by Microsoft's advisory and The Hacker News' coverage; CZ's post is a statement, not a technical source on the vulnerability.
Also on Geekiki: CVE-2026-19868: SonicWall flaw lets attackers bypass SSL-VPN MFA and is already being exploited
Image credit: illustration from The Hacker News' original report on CVE-2026-83844. Image: The Hacker News.
Sources
- The Hacker News — Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It
- Weex — Binance Founder Changpeng Zhao Shares Warning on Windows Paint Vulnerability CVE-2026-83844
Transparency: this article was produced with the assistance of artificial intelligence, cross-checking public posts on X and sources on the internet. We recommend consulting the original sources listed below to confirm the details.
Muse
