# Microsoft Paint RCE CVE-2026-83844 fixed in Store build 11.2609.401.0 (not via Windows Update) · pwn.watch > CVE-2026-83844 is an out-of-bounds read in Microsoft Paint that Microsoft rates Important with CVSS 8.1. It can allow remote code execution over a network with no sign-in and no user interaction, at high attack complexity. Microsoft published the issue on Oct 13 2026 as a Microsoft Store security update, not a Windows Update. The public CVE record still lists Paint as affected below 11.2605.91.0, while MSRC remediation names fixed build 11.2609.401.0 — scanners that trust only the CVE range may wrongly clear older Store builds. As of Nov 6 2026, The Hacker News and RFF reported that Store catalogs in multiple countries were serving 11.2609.401.0. Admins should inventory every user copy and the provisioned package and update Paint through the Store (or MDM Store-app update scans) to 11.2609.401.0 or later. Not known to be exploited or publicly disclosed at Microsoft's publication; not in CISA KEV when THN checked Nov 6. Page: https://pwn.watch/i/microsoft-paint-rce-cve-2026-83844-store-fix-nov-2026 · generated 2026-11-06T17:04:01.956Z ## Status - Severity: high · status: live · patch: patched - Product: Microsoft Paint (Microsoft Store app) - Started: 2026-10-13 - CVEs: CVE-2026-83844 - Affected: Microsoft Paint builds below 11.2609.401.0 (MSRC fixed build); CVE record still describes affected range as below 11.2605.91.0 - Fixed in: Microsoft Paint 11.2609.401.0 or later via Microsoft Store (not Windows Update) ## Follow this incident - RSS (one item per update): https://pwn.watch/i/microsoft-paint-rce-cve-2026-83844-store-fix-nov-2026/feed.xml - JSON Feed: https://pwn.watch/i/microsoft-paint-rce-cve-2026-83844-store-fix-nov-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/microsoft-paint-rce-cve-2026-83844-store-fix-nov-2026.json - This file: https://pwn.watch/i/microsoft-paint-rce-cve-2026-83844-store-fix-nov-2026/llms.txt ## Updates (newest first) - 2026-11-06: The Hacker News and RFF report Microsoft Store now offering Paint 11.2609.401.0 in checked markets; Windows Update still does not deliver the fix. (https://thehackernews.com/2026/11/microsoft-paint-rce-fix-now-available.html) - 2026-11-05: RFF reports Store catalogs in multiple countries still topping out at Paint 11.2605.81.0, below the MSRC-named fixed build 11.2609.401.0. (https://getrff.com/blog/windows-paint-cve-2026-83844-store-fix-missing/) - 2026-10-13: Microsoft publishes CVE-2026-83844 for a Paint out-of-bounds read RCE delivered as a Store security update. (https://thehackernews.com/2026/11/microsoft-paint-rce-fix-now-available.html) ## Fix brief # Security brief: Microsoft Paint RCE CVE-2026-83844 fixed in Store build 11.2609.401.0 (not via Windows Update) Source: https://pwn.watch/i/microsoft-paint-rce-cve-2026-83844-store-fix-nov-2026 · status: live · severity: high · updated Nov 6, 2026, 14:10 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is CVE-2026-83844 is an out-of-bounds read in Microsoft Paint that Microsoft rates Important with CVSS 8.1. It can allow remote code execution over a network with no sign-in and no user interaction, at high attack complexity. Microsoft published the issue on Oct 13 2026 as a Microsoft Store security update, not a Windows Update. The public CVE record still lists Paint as affected below 11.2605.91.0, while MSRC remediation names fixed build 11.2609.401.0 — scanners that trust only the CVE range may wrongly clear older Store builds. As of Nov 6 2026, The Hacker News and RFF reported that Store catalogs in multiple countries were serving 11.2609.401.0. Admins should inventory every user copy and the provisioned package and update Paint through the Store (or MDM Store-app update scans) to 11.2609.401.0 or later. Not known to be exploited or publicly disclosed at Microsoft's publication; not in CISA KEV when THN checked Nov 6. Severity detail: MS Important / CVSS 8.1 network RCE with no auth or user interaction but high attack complexity; not known exploited at publication; fix is Store-only so fleets can lag - Product: Microsoft Paint (Microsoft Store app) - CVE / advisory ids: CVE-2026-83844 ## Affected versions - Microsoft Paint builds below 11.2609.401.0 (MSRC fixed build); CVE record still describes affected range as below 11.2605.91.0 ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - Microsoft Paint 11.2609.401.0 or later via Microsoft Store (not Windows Update) After upgrading, re-run the checks above and redeploy/restart the affected services. ## Specific notes Inventory (from THN/RFF): Get-AppxPackage -AllUsers -Name Microsoft.Paint; Get-AppxProvisionedPackage -Online | Where-Object DisplayName -eq 'Microsoft.Paint' ## Latest updates - Nov 6, 2026: The Hacker News and RFF report Microsoft Store now offering Paint 11.2609.401.0 in checked markets; Windows Update still does not deliver the fix. - Nov 5, 2026: RFF reports Store catalogs in multiple countries still topping out at Paint 11.2605.81.0, below the MSRC-named fixed build 11.2609.401.0. - Oct 13, 2026: Microsoft publishes CVE-2026-83844 for a Paint out-of-bounds read RCE delivered as a Store security update. ## Advisories - [CVE-2026-83844](https://nvd.nist.gov/vuln/detail/CVE-2026-83844) (NVD) ## Write-ups & news - [Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It](https://thehackernews.com/2026/11/microsoft-paint-rce-fix-now-available.html) - [Windows Paint CVE-2026-83844: the fixed build is in the Microsoft Store now](https://getrff.com/blog/windows-paint-cve-2026-83844-store-fix-missing/) ## Caveats Paint is per-user Store app plus a provisioned package; checking only the signed-in user can miss older copies. Prefer MSRC fixed build 11.2609.401.0 over the older CVE-record cutoff. --- Machine-readable: https://pwn.watch/i/microsoft-paint-rce-cve-2026-83844-store-fix-nov-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.