Your Questions on the Windows Paint Flaw Whose Fix Never Shows Up in Windows Update, Answered
A remote-code-execution flaw in Windows Paint, CVE-2026-83844, is fixed in Microsoft Store build 11.2609.401.0. Windows Update will not deliver that build. Here is how to tell whether every copy of Paint on a PC is actually patched.
Clicking Check for updates will not close this hole. A remote-code-execution flaw in Windows Paint is fixed, but the repaired app arrives through the Microsoft Store, not through Windows Update.
The questions and answers below follow The Hacker News report on CVE-2026-83844 and on build checks by Brian Vitko of device-management firm RFF.
Q: What is the flaw?
CVE-2026-83844 is an out-of-bounds read in Windows Paint that could let an attacker run code over a network. Microsoft rates it Important, with a CVSS score of 8.1, and says a successful attack requires a deep understanding of the target system. The company published the issue on October 13 and said it was not known to be exploited or publicly disclosed at that time. The advisory describes an attacker sending “a specially crafted packet to an affected service over the network.” It does not name that service. The Hacker News notes that the attack would require no sign-in and no help from the user.
Q: If there is a fix, why is Windows Update not enough?
Paint receives this fix only as a Store update. The Hacker News checked the Store in ten countries and found that the newest Paint build on offer in each was 11.2609.401.0, the build Microsoft’s security advisory names as fixed. Windows Update does not deliver that build. Vitko had checked the Store in six countries earlier in the week and still saw 11.2605.81.0—a build without the fix—as the newest copy. His own test virtual machine later moved to the fixed build through Store auto-update. How quickly other PCs will follow is not yet clear.
Q: Why might a vulnerability scanner say you are already safe?
The CVE record, which Microsoft also publishes, still lists Paint as affected only below version 11.2605.91.0. The National Vulnerability Database entry shows the same range. A scanner that trusts that record would treat any build from 11.2605.91.0 upward as fixed, even if the copy is older than 11.2609.401.0. The Hacker News also notes that as recently as last week the advisory itself listed 11.2605.91.0 as the fixed build, according to a question on Microsoft Q&A, and that the advisory’s revision history still showed only its October 13 entry.
Q: How do you check every copy of Paint on a PC?
Paint, like other Store apps, is installed separately for each user account. Windows can also keep a provisioned copy that it installs for each new user, so checking only the signed-in account can miss older copies. Vitko’s write-up, as quoted by The Hacker News, gives two commands to run in an administrator PowerShell window. The first lists every user’s copy; the second lists the provisioned copy:
Get-AppxPackage -AllUsers -Name Microsoft.Paint | Select-Object Version, @{ n = 'Users'; e = { $_.PackageUserInformation.UserSecurityId.Username -join ', ' } }
Get-AppxProvisionedPackage -Online | Where-Object DisplayName -eq 'Microsoft.Paint' | Select-Object Version
For any copy below 11.2609.401.0, update Paint through the Store or let Store auto-update install the fixed build. In Microsoft Intune and other device-management tools, a Store app update scan does that across many PCs. Then run both commands again and confirm that every copy shows 11.2609.401.0 or later. The advisory lists no workaround. Before the fix reached the Store, Vitko suggested removing Paint where nobody needs it—for every user and from the provisioned copy—but he did not test that step.
Q: Is anyone exploiting this right now?
The Hacker News said the flaw was not in CISA’s Known Exploited Vulnerabilities catalog when it checked, and that the catalog had last been updated earlier this week. Microsoft, at publication in October, said the issue was not known to be exploited.
What this means for your company
A “we ran Windows Update” report is not the same as “every inbox on every PC has the security fix.” Store apps such as Paint live on a different update path, they install per user, and a leftover provisioned copy can put an old version back when someone new signs in. Build a short list of Store apps that matter on your PCs, check them with an all-users query rather than a glance at one desktop, and make sure your device-management tool is actually scanning for Store updates—not only for Windows patches. If a scanner and Microsoft’s advisory disagree about which build is safe, believe the higher build number until you have confirmed otherwise.
Need help checking every copy of Paint across your PCs, or confirming other Store apps are actually receiving their security fixes? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
