Microsoft Paint CVE-2026-83844: the fix skips Windows Update

Microsoft published CVE-2026-83844 on October 13, 2026. The company describes it as an out-of-bounds read in Windows Paint, with remote code execution as the impact. The rating is Important and the score is 8.1. Microsoft also says turning the bug into a working attack takes a deep knowledge of the target system. The advisory’s conditions are an outsider on the network, with no account on the PC and no action from the person at the keyboard. At publication, Microsoft did not know of exploitation or of a public write-up. The Hacker News checked the CISA Known Exploited Vulnerabilities catalog on November 6 and did not find this CVE. The catalog had been refreshed earlier that week.

The delivery channel is the story for defenders. Paint is a Microsoft Store app. The build that closes the bug, 11.2609.401.0, comes from the Store. A monthly Windows rollup does not carry it. A fleet that is current on Patch Tuesday can still be running the vulnerable Paint.

Two version numbers, and a scanner that will trust the lower one

Microsoft’s advisory names 11.2609.401.0 as the fixed build. The CVE record the company publishes, and the NVD page that mirrors it, still describe Paint as affected only below 11.2605.91.0. A scanner that trusts that range will mark 11.2605.91.0 and anything newer as patched, including builds the advisory has not cleared.

The Hacker News notes that a Microsoft Q&A thread from the previous week showed the advisory itself listing 11.2605.91.0. The advisory’s revision history still shows only the October 13 entry, with no line that explains the later number. Hold the fleet to 11.2609.401.0. A copy at that build or later satisfies both the advisory and the CVE range. Older copies stay in the bug, including when a scanner prints a clean result.

Brian Vitko of RFF, a device-management software maker, checked the Store in six countries earlier this week. In each, the newest Paint on offer was 11.2605.81.0, which sits under both thresholds. One lab virtual machine he was watching later picked up 11.2609.401.0 on its own after Store auto-update ran. A single lab image is not a rollout. The Hacker News looked at the Store in ten countries on November 6 and saw 11.2609.401.0 as the newest in each. A build that exists in the catalog is not the build sitting on a PC that has not opened the Store.

Read every account, including the one Windows has not created yet

Paint is installed per user. Windows also keeps a provisioned copy that it lays down for the next account created on that PC. A version taken from the signed-in profile can miss an older copy under another user, and it can miss the package new accounts will inherit.

Read the version for every user, and read the provisioned package. Both have to show 11.2609.401.0 or later. Then push the Store update. On a managed fleet, the Store app update scan in Intune, and the same scan in other device-management tools, is how the build reaches machines nobody opens by hand. Inventory again after the scan. A ticket that says Windows is patched says nothing about Paint.

The advisory lists no workaround. Before the fixed build was in the Store, Vitko suggested removing Paint for every user and from the provisioned copy on machines where nobody uses it. He did not test that removal. With 11.2609.401.0 available, the action is the Store update. Where the Store cannot reach a PC, keep that host off networks you do not trust until Paint is current or has been removed, and look for a version string rather than a missing Windows Update article. There is no article for this one.

A score of 8.1 with no known exploitation is still a remote bug in a program that ships with Windows and updates on a separate channel. Confirm the Store build. The date on the monthly rollup will not answer the question.

This briefing relies on public reporting by The Hacker News, on Brian Vitko’s version checks, and on Microsoft’s advisory for CVE-2026-83844. It does not include exploit procedures.