Microsoft Paint RCE CVE-2026-83844 fixed in Store build 11.2609.401.0 (not via Windows Update)

CVE-2026-83844 is an out-of-bounds read in Microsoft Paint that Microsoft rates Important with CVSS 8.1. It can allow remote code execution over a network with no sign-in and no user interaction, at high attack complexity. Microsoft published the issue on Oct 13 2026 as a Microsoft Store security update, not a Windows Update. The public CVE record still lists Paint as affected below 11.2605.91.0, while MSRC remediation names fixed build 11.2609.401.0 — scanners that trust only the CVE range may wrongly clear older Store builds. As of Nov 6 2026, The Hacker News and RFF reported that Store catalogs in multiple countries were serving 11.2609.401.0. Admins should inventory every user copy and the provisioned package and update Paint through the Store (or MDM Store-app update scans) to 11.2609.401.0 or later. Not known to be exploited or publicly disclosed at Microsoft's publication; not in CISA KEV when THN checked Nov 6.

Why this severity: MS Important / CVSS 8.1 network RCE with no auth or user interaction but high attack complexity; not known exploited at publication; fix is Store-only so fleets can lag

Started

Oct 13, 2026

CVE

CVE-2026-83844

• Microsoft
• #Paint
• RCE
• #Microsoft Store

Notes & caveats

Paint is per-user Store app plus a provisioned package; checking only the signed-in user can miss older copies. Prefer MSRC fixed build 11.2609.401.0 over the older CVE-record cutoff.