#Paint

Microsoft Paint RCE CVE-2026-83844 fixed in Store build 11.2609.401.0 (not via Windows Update)

CVE-2026-83844 is an out-of-bounds read in Microsoft Paint that Microsoft rates Important with CVSS 8.1. It can allow remote code execution over a network with no sign-in and no user interaction, at high attack complexity. Microsoft published the issue on Oct 13 2026 as a Microsoft Store security update, not a Windows Update. The public CVE record still lists Paint as affected below 11.2605.91.0, while MSRC remediation names fixed build 11.2609.401.0 — scanners that trust only the CVE range may wrongly clear older Store builds. As of Nov 6 2026, The Hacker News and RFF reported that Store catalogs in multiple countries were serving 11.2609.401.0. Admins should inventory every user copy and the provisioned package and update Paint through the Store (or MDM Store-app update scans) to 11.2609.401.0 or later. Not known to be exploited or publicly disclosed at Microsoft's publication; not in CISA KEV when THN checked Nov 6.

Microsoft Paint (Microsoft Store app)·Since Oct 13, 2026·updated Nov 6, 2026, 14:10 UTC