Microsoft Paint’s fix for CVE-2026-83844 is now available in the Microsoft Store, but organizations relying on Windows Update will not receive it there. The affected application is the Microsoft Store version of Paint, and the build to verify is 11.2609.401.0.
The newly available package was observed by RFF’s Brian Vitko in the US, UK and Germany at 04:14 UTC on November 6. RFF also reports that a domain-joined lab virtual machine obtained the fixed build through Store auto-update, including the signed-in user’s copy and the provisioned copy used for new profiles. That is a lab observation, not confirmation that every endpoint has received the update. RFF’s update and lab findings
The Hacker News reports that Microsoft describes CVE-2026-83844 as an out-of-bounds read that could enable remote code execution over a network. Microsoft rates it Important with a CVSS score of 8.1; the attack is described as requiring no sign-in or user interaction but high attack complexity. The flaw was not known to be exploited or publicly disclosed when Microsoft published its security information. The Hacker News’ vulnerability and remediation report
Administrators should distinguish the Store-delivered application update from Windows servicing. The Hacker News reports that Paint’s fix is delivered through the Store, while RFF says Microsoft’s security data identifies 11.2609.401.0 as the fixed build and marks customer action as required. RFF further reports that the public CVE record still treats versions below 11.2605.91.0 as affected, creating a version-checking discrepancy; using 11.2609.401.0 or later avoids that ambiguity.
The attack trigger remains unclear: Microsoft’s description refers to a specially crafted network packet sent to an affected service but does not identify that service. Neither fetched report confirms exploitation or compromise.