cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

Microsoft Paint CVE-2026-83844 Fix Requires a Microsoft Store Update

· Original article ↗

Summary

Microsoft Paint's CVE-2026-83844 fix is available through the Store, not Windows Update. The article notes conflicting fixed-version records and provides commands to check per-user and provisioned copies; rollout timing is unclear.

Key points

  • CVE-2026-83844 is an out-of-bounds read that could enable network remote code execution via a specially crafted packet; the advisory does not name the affected service.
  • Microsoft rates the flaw Important with a CVSS score of 8.1. It was not known to be exploited or publicly disclosed when Microsoft published it on October 13.
  • Microsoft identifies Paint build 11.2609.401.0 as fixed. The fix is available through the Microsoft Store, not Windows Update.
  • The article found build 11.2609.401.0 offered in ten countries; an earlier check by Brian Vitko found the older 11.2605.81.0 build in six countries. Update timing for other PCs remains unclear.
  • Microsoft's advisory names 11.2609.401.0 as fixed, while the CVE record and NVD list builds below 11.2605.91.0 as affected, creating a version-range discrepancy for scanners.
  • Paint is installed separately for each user, and Windows may also keep a provisioned copy for new users. The article provides PowerShell commands to check both.
  • The advisory lists no workaround or mitigation. Removing Paint was suggested before the fix arrived, but Vitko did not test that step.

Article Details

Vulnerability Types
  • Out-of-bounds read
  • Remote code execution
Severity
Important; CVSS 8.1
Affected Versions
  • Microsoft Paint versions below 11.2605.91.0 (per the CVE record and NVD)
Exploitation Status
not_reported
Exploit Availability
unknown
Patch Status
available
Workarounds
  • Before the Store fix arrived, Brian Vitko suggested removing Paint for every user and from the provisioned copy if it was not needed; he did not test this.

MITRE ATT&CK

T1210 · Exploitation of Remote ServicesThe advisory says an attacker could send a specially crafted packet over the network to an affected service to exploit the flaw; the service is not named.

CVE

CVE-2026-83844Microsoft · Microsoft PaintA fix for CVE-2026-83844, a remote code execution flaw in Windows Paint, is now in the Microsoft Store. Paint gets this fix only through a Store update, not through Windows updates.

People

Brian VitkoChecked Paint builds offered in several countries, documented how to inspect installed and provisioned copies, and suggested removing Paint as a temporary measure; he did not test that measure.

Vendors

MicrosoftA fix for CVE-2026-83844, a remote code execution flaw in Windows Paint, is now in the Microsoft Store. Paint gets this fix only through a Store update, not through Windows updates.

Products

Microsoft StoreA fix for CVE-2026-83844, a remote code execution flaw in Windows Paint, is now in the Microsoft Store. Paint gets this fix only through a Store update, not through Windows updates.Windows PaintA fix for CVE-2026-83844, a remote code execution flaw in Windows Paint, is now in the Microsoft Store. Paint gets this fix only through a Store update, not through Windows updates.

Related Articles