Microsoft has made available a fix for CVE-2026-83844, a remote code execution vulnerability in Windows Paint. Unlike most Windows component patches, this fix is delivered only through a Microsoft Store update, not through the standard Windows Update channel. Organizations that depend on Windows Update alone to keep endpoints current may therefore have Paint still running a vulnerable build.

What the flaw is

The vulnerability is an out-of-bounds read in Paint. According to the report, an attacker could exploit it to execute code over a network. The source did not include the full severity rating Microsoft assigned, so readers should consult the vendor advisory for the official score.

The fixed build

The patched version is Paint build 11.2609.401.0. The Hacker News reported that this was the newest Paint build available in all ten countries it checked on the day of publication, which suggests the update is rolling out broadly through the Store rather than being limited to a single region.

Why the delivery channel matters

  • Paint is distributed as a Store app, so its patch cadence is separate from cumulative Windows updates.
  • Systems that receive Windows Update but have Store updates disabled, restricted by policy, or blocked on managed devices may remain exposed.
  • Inventory tools that only check Windows build numbers will not reliably confirm whether Paint is patched.

Recommended actions

  • Confirm the installed Paint version on managed endpoints and verify it is 11.2609.401.0 or later.
  • Check that Microsoft Store app updates are permitted in your environment, including any policies that block Store access.
  • Use your endpoint management platform to push or force the Store update where automatic delivery is not occurring.
  • Review the official Microsoft advisory for CVE-2026-83844 for severity details and any workaround guidance.

The core takeaway for defenders is that a patch being available does not mean it is deployed. Because this fix follows a different delivery path than most Windows security updates, it deserves a specific check in your patch verification process.