Paint RCE Fix Ships Only via Microsoft Store, Not Windows Update
Windows Paint carries CVE-2026-83844, an out-of-bounds read that lets an unauthenticated attacker run code over the network without user interaction (CVSS 8.1). The fix exists but ships only through the Microsoft Store, not Windows Update; the fixed build 11.2609.401.0 was already the newest in ten countries checked by The Hacker News. There are no confirmed reports of active exploitation; update Paint through the Store.
What happened
Microsoft has fixed CVE-2026-83844 in Windows Paint, a flaw that let an unauthenticated attacker run code over the network without user interaction. The fix, however, arrives only through the Microsoft Store, not Windows Update. The fixed build is 11.2609.401.0, already the newest in ten countries checked.
Why it matters
Any company running Windows may have machines with old Paint versions open to remote code execution, with a CVSS score of 8.1. Because Windows Update does not deliver the fix, computers that rely on that channel alone stay vulnerable without the team noticing. There are no confirmed reports of active exploitation, according to DarkWebInformer.
What to do
Update Paint through the Microsoft Store on all Windows computers and confirm the installed build is 11.2609.401.0 or later. Include Store apps in the regular update process, not only Windows Update.
For the technical team
- CVE
- CVE-2026-83844
- Affected
- Microsoft Paint do Windows · Microsoft Paint versions earlier than 11.2605.91.0, according to DarkWebInformer.
- Exploitation
- No confirmed reports of active exploitation, according to DarkWebInformer. No public PoC cited in the sources.
- Fix
- Build 11.2609.401.0, delivered only through the Microsoft Store, not Windows Update (The Hacker News). Microsoft initially listed 11.2605.91.0 as the fixed release (The_Cyber_News, DarkWebInformer).
- Vector
- Component: Windows Paint. Failure type: out-of-bounds read. Condition: an unauthenticated attacker executes code over the network, with no user interaction; it compromises confidentiality, integrity, and availability, according to DarkWebInformer.
- More details
- CVSS 8.1, High (Pirat_Nation, DarkWebInformer). Microsoft published a security advisory and a fix. Administrators reported the Store kept offering 11.2605.81.0 even after update checks and Store cache steps (The_Cyber_News). The Hacker News checked ten countries and 11.2609.401.0 was the newest build in all of them.
Timeline
The fix ships only via Microsoft Store update, not Windows Update; fixed build 11.2609.401.0 was already the newest in ten countries checked.
Flaw details: an out-of-bounds read that lets an unauthenticated attacker execute code over the network without user interaction; the fixed release is Paint 11.2605.91.0.
Incident opened.
Sources 4 sources
- @Pirat_Nation @Pirat_Nation
- @DarkWebInformer @DarkWebInformer
- @The_Cyber_News @The_Cyber_News
- Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It The Hacker News
