Microsoft Paint CVE-2026-83844 Explained: The RCE Fix Windows Update Won't Deliver

on

Microsoft Paint CVE-2026-83844 explained — Windows key on a laptop keyboard

Image: Pexels / Ruben Boekeloo (illustrative image)

TL;DR — Microsoft Paint CVE-2026-83844 explained: a remote code execution flaw (CVSS 8.1) in the Paint app lets an unauthenticated attacker run code over a network. Microsoft published the flaw on 13 October 2026, but the fix only reached the Microsoft Store on 6 November — Windows Update will never deliver it. Check your Paint build: you need 11.2609.401.0 or later.

📌 KEY HIGHLIGHTS

  • The flaw: CVE-2026-83844 is an out-of-bounds read in Windows Paint that Microsoft rates as remote code execution — CVSS 8.1, Important severity.
  • The catch: Paint is a Microsoft Store app, so its fix comes only through the Store. A PC with Windows fully updated can still run a vulnerable Paint.
  • The fixed build is 11.2609.401.0 — but Microsoft's own CVE record still says builds below 11.2605.91.0 are affected, so version scanners can get this wrong.
  • Not exploited yet: no known exploitation and no public disclosure when Microsoft published it on 13 October; it is not in CISA's Known Exploited Vulnerabilities catalog as of 6 November.
  • Check in two minutes: one PowerShell command shows your Paint version — and the Store's "up to date" message is not proof you have the fix.

Microsoft Paint CVE-2026-83844 explained: what the flaw does

CVE-2026-83844 is an out-of-bounds read — weakness CWE-125 — in Microsoft Paint. The CVE record puts it plainly: "Out-of-bounds read in Windows Paint allows an unauthorized attacker to execute code over a network." In other words, the app reads memory beyond the region it was supposed to use, and an attacker who can reach the affected service over the network can turn that into running their own code on the machine.

Microsoft rates the flaw Important, with a CVSS 3.1 score of 8.1 (High) — network attack vector, no privileges required, no user interaction, but high attack complexity, meaning a successful attack requires a deep understanding of the target system. Its advisory says an attacker could exploit it by "sending a specially crafted packet to an affected service over the network," but it does not name the service, and Microsoft has not published the full attack path. It has also not said that opening an image triggers the flaw, so do not treat that as confirmed. Security coverage has informally dubbed the flaw "Paint2Shell" — a nickname, not Microsoft's name for it.

The reassuring part: when Microsoft published the flaw on 13 October 2026, it was not known to be exploited and not publicly disclosed, and it was still absent from CISA's Known Exploited Vulnerabilities catalog when The Hacker News checked on 6 November. Microsoft's own exploitability assessment is "less likely." That tempers the urgency — but there is no workaround or mitigation listed in the advisory, so patching is the only defence.

Why Windows Update won't fix it

Paint is no longer a piece of Windows itself. On Windows 11 it is a Microsoft Store app, serviced through the Store like any other app — so the security fix travels through the Store, not through Windows Update. Microsoft marks this CVE "Customer Action Required: Yes," which is its way of saying the patch will not simply arrive with your next Windows update.

That creates a trap for anyone who judges their security by the Windows Update screen. A PC can show "You're up to date" while running a Paint build from months ago, because Windows Update never touches Store apps. Enterprise patching has the same blind spot: WSUS covers Windows itself, not Store app updates, so fleets managed that way need a separate Store app update scan.

Making it worse, Microsoft's own records disagree about which build counts as fixed:

DateWhat happenedPaint build in the Store
13 Oct 2026Microsoft publishes CVE-2026-83844 and names a fixed build11.2605.91.0 (named fixed)
30 Oct 2026A user on Microsoft Q&A reports 11.2605.91.0 is not findable in any Store channel11.2605.81.0 (unfixed)
2 Nov 2026Microsoft's October security data (CVRF/API) now lists a different fixed build11.2609.401.0 (named fixed)
5 Nov 2026RFF checks the Store catalog in six countries, including India — the fixed build is still not there; Windows Latest's PC with Store auto-update on still runs 11.2603.251.011.2605.81.0 (unfixed)
6 Nov 2026The Store starts returning the fixed build; The Hacker News checks ten countries and it is the newest in all of them; RFF's lab VM picks it up through Store auto-update11.2609.401.0 (fixed)

The CVE record still lists builds below 11.2605.91.0 as affected, and the advisory's revision history still shows only its 13 October entry, with no note about the change. A scanner that reads the CVE record would therefore treat any build from 11.2605.91.0 up as fixed — wrongly. The practical rule is simple: treat only 11.2609.401.0 or later as fixed, because that build passes under both numbers.

A laptop screen running photo editing software — Microsoft Paint is a Store app, so its fix comes from the Store

Image: Pexels / Mathias Reding (illustrative image)

How to check your Paint version

Paint is installed separately for each user account on a PC, and Windows also keeps a provisioned copy that it installs for each new user. Checking only the signed-in account can miss older copies, so check them all. Open PowerShell as administrator and run these commands, from the write-up by RFF's Brian Vitko that The Hacker News cites:

Your own copy:

Get-AppxPackage -Name Microsoft.Paint | Select-Object Name, Version

Every user's copy:

Get-AppxPackage -AllUsers -Name Microsoft.Paint | Select-Object Version, @{ n = 'Users'; e = { $_.PackageUserInformation.UserSecurityId.Username -join ', ' } }

The provisioned copy for new users:

Get-AppxProvisionedPackage -Online | Where-Object DisplayName -eq 'Microsoft.Paint' | Select-Object Version

Any copy below 11.2609.401.0 needs the update. Do not rely on the Store telling you Paint is "up to date" — earlier this week the Store said exactly that while offering only the unfixed 11.2605.81.0 build.

How to update Paint to the fixed build

Open the Microsoft Store, go to Library, and click Get updates — or simply wait for Store auto-update, which has already delivered 11.2609.401.0 to test machines. Then run the check commands again and confirm every copy shows 11.2609.401.0 or later. On managed fleets, Intune and other device-management tools can push the Store app update scan across many PCs at once.

Before the fix reached the Store, RFF's Vitko suggested removing Paint where nobody needs it. That was a stopgap for a week when no fix existed; now that the fixed build is live in the Store, updating is the answer and removal is no longer needed. Microsoft lists no workaround or mitigation in the advisory, so there is no other way to close the hole.

What it means for Windows users in India

Windows is the dominant desktop operating system in India, and Paint is on virtually every Windows PC — in homes, offices, schools and cyber cafés. That makes the delivery gap the real story here: RFF's Store check on 5 November explicitly included India, and the Store there was still offering the unfixed build, just like everywhere else.

Many Indian users rarely open the Microsoft Store at all and judge their security by Windows Update. For them, this flaw is invisible twice over — Windows says the PC is up to date, and the Store may say Paint is up to date, while the app itself is still vulnerable. Shared PCs make the check more important, not less: because Paint is installed per user, a family computer, college lab machine or cyber café PC can carry several copies at different versions, and the all-users command above is the only way to see them all.

There is no India-specific angle to overstate here — no Indian victim has been reported and no CERT-In advisory for this CVE has been issued — but the exposure is the same for Indian Windows users as for anyone else, and the fix takes the same two minutes.

Should you care?

Yes — check now, it takes two minutes. The flaw is not being exploited, the attack is hard to pull off, and the fix is already in the Store, so this is not a drop-everything emergency. But it is exactly the kind of hole that stays open for months: no workaround exists, Windows Update will never deliver the fix, and the version numbers are confusing enough that even scanners can call a vulnerable PC safe. Run the PowerShell check, update Paint from the Store if you are below 11.2609.401.0, and re-check. For a related lesson in patching what Windows Update does not cover, see the Barracuda Email Security Gateway chain that also reaches root without a login and the OpenSSH 10.6p2 password bypass on Alpine Linux. And if you want the wider picture of how fast AI is compressing attack timelines, read CERT-In's warning that AI tools are hacking banks at machine speed.

FAQs

How do I check which version of Microsoft Paint I have?
Open PowerShell as administrator and run Get-AppxPackage -Name Microsoft.Paint | Select-Object Name, Version. To see every user's copy, add -AllUsers, and check the provisioned copy with Get-AppxProvisionedPackage -Online | Where-Object DisplayName -eq 'Microsoft.Paint'. You need 11.2609.401.0 or later.

Does Windows Update fix the Microsoft Paint vulnerability?
No. Paint is a Microsoft Store app, so its security fix comes only through the Microsoft Store — Windows Update never delivers it. A PC that shows "You're up to date" in Windows Update can still run a vulnerable Paint.

How do I update Microsoft Paint to the fixed version?
Open the Microsoft Store, go to Library, and click Get updates — or wait for Store auto-update. Then re-run the PowerShell version check and confirm every copy shows 11.2609.401.0 or later. On managed fleets, use your device-management tool's Store app update scan.

What is CVE-2026-83844?
It is an out-of-bounds read (CWE-125) in Windows Paint that allows an unauthenticated attacker to execute code over a network. Microsoft rates it Important with a CVSS 3.1 score of 8.1 (High). It was published on 13 October 2026 and the fixed Paint build, 11.2609.401.0, reached the Microsoft Store on 6 November.

Is CVE-2026-83844 being exploited?
No. Microsoft said it was not known to be exploited and not publicly disclosed when it published the flaw on 13 October 2026, and it was still absent from CISA's Known Exploited Vulnerabilities catalog when checked on 6 November. Microsoft's exploitability assessment is "less likely" — but with no workaround available, patching is still the right move.

Takeaway: Microsoft Paint has a real remote code execution flaw, and its fix hides in the Microsoft Store — not in Windows Update. Open PowerShell, run the one-line version check, and if you are below 11.2609.401.0, update Paint from the Store today. Your Windows Update status will not warn you.

Sources

Comments

Post a Comment