← All posts · November 4, 2026 · By Brian Vitko

Windows Paint CVE-2026-83844: the fixed build isn’t in the Microsoft Store yet. Check your fleet

CVE-2026-83844 is an out-of-bounds read in Windows Paint that Microsoft rates as remote code execution: CVSS 8.1, over the network, no sign-in, no user interaction, high attack complexity. Microsoft published it on October 13 and rates it Important. It isn’t known to be exploited or publicly disclosed.

Paint is a Microsoft Store app, so the fix doesn’t come through Windows Update. It comes when the Store updates Paint, and Microsoft marks the CVE “Customer Action Required: Yes”. Windows Latest found their PC on Paint 11.2603.251.0 with Store auto-updates on and no update offered, and admins on Reddit couldn’t find one either.

I checked why: the fixed build Microsoft names isn’t in the Store.

Which build is fixed

The fixed build has changed once already:

11.2605.91.0 never showed up anywhere, and on November 4 Microsoft replaced it with 11.2609.401.0 in its machine-readable October security data. That’s the build to go by.

On November 5 at 03:34 UTC I asked the Store’s own product catalog which Paint packages it has, for the US, UK, Germany, Australia, India and Singapore (Microsoft’s advisory links the Singapore listing). Every market listed the same newest package: 11.2605.81.0. Nothing newer exists for the Store to install.

What we found in the lab

Both of our Windows 11 lab machines, an HP EliteOne and a domain-joined VM, had Paint 11.2605.81.0 for every user, and so did the provisioned copy that new profiles get. Both are up to date as far as the Store is concerned and both are below the fixed build.

On the VM I ran the Store update scan that Intune and other MDMs use (UpdateScanMethod on MDM_EnterpriseModernAppManagement_AppManagement01, as SYSTEM) and watched Paint for four minutes. It stayed on 11.2605.81.0, because the Store has nothing newer to give it.

Microsoft’s FAQ says an attacker could exploit it “by sending a specially crafted packet to an affected service over the network”. That’s an odd description for an image editor, and the advisory doesn’t say more. I don’t know what the real trigger is.

Check one machine

From an elevated PowerShell, every user’s copy and the provisioned one:

Get-AppxPackage -AllUsers -Name Microsoft.Paint |
    Select-Object Version, @{ n = 'Users'; e = { $_.PackageUserInformation.UserSecurityId.Username -join ', ' } }
Get-AppxProvisionedPackage -Online | Where-Object DisplayName -eq 'Microsoft.Paint' | Select-Object Version

Don’t drop the -AllUsers. Without it you only see your own copy, and Store apps are installed per user. Anything below 11.2609.401.0 is vulnerable.

And what the Store is serving right now (change market=US to your country code):

$u = 'https://displaycatalog.mp.microsoft.com/v7.0/products?bigIds=9PCFS5B6T72H&market=US&languages=en-us'
[regex]::Matches((Invoke-WebRequest $u -UseBasicParsing).Content, 'Microsoft\.Paint_([\d.]+)_') |
    ForEach-Object { [version]$_.Groups[1].Value } | Sort-Object -Unique | Select-Object -Last 1

If that prints 11.2609.401.0 or later, the fix is out and a Store update will install it.

What to do

1. Find every machine with Paint below 11.2609.401.0, per user and the provisioned copy.

2. Bring anything older than the Store’s newest (11.2605.81.0 today) up to it. Windows Latest’s 11.2603.251.0 is two releases behind even that. Your MDM’s “update Store apps” (the scan above) does it fleet-wide.

3. Where nobody needs Paint, consider removing it until the fix ships, for every user and from the provisioned copy so new profiles don’t get it back:

   Get-AppxPackage -AllUsers -Name Microsoft.Paint | Remove-AppxPackage -AllUsers
   Get-AppxProvisionedPackage -Online | Where-Object DisplayName -eq 'Microsoft.Paint' | Remove-AppxProvisionedPackage -Online

   Users can put it back from the Store later. I didn’t test removal in the lab, so try it on one machine first.

4. Check the Store again over the next few days. When 11.2609.401.0 shows up, run the update scan everywhere.

Doing it with RFF

The RFF Script Library has a Paint check for CVE-2026-83844 that lists every installed Paint version with the users who have it, the provisioned copy, and the newest Paint the Store is serving for that machine’s region, so “not updated yet” and “nothing to update to” read differently. A second entry runs the Store update scan as SYSTEM, waits for Paint to change and reports whether it reached 11.2609.401.0. There’s also a Check that alerts on any machine below the fixed build and clears by itself once the Store delivers it. We ran the version check on both Windows 11 lab machines and the update and the Check on the VM. Today they all report vulnerable, with the Store’s newest at 11.2605.81.0.

RFF is free for your first 100 endpoints: getrff.com.

Sources

• Microsoft Security Update Guide, CVE-2026-83844: CVSS, description, FAQ, Store delivery
• MSRC October 2026 security data (CVRF): fixed build 11.2609.401.0, “Customer Action Required”
• Windows Latest: auto-update not delivering the fix, the 11.2603.251.0 machine
• Microsoft Q&A: Microsoft Paint 11.2605.91.0: the earlier fixed build that couldn’t be found
• Microsoft Store listing for Paint: the package the advisory links