Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It
Fixed build 11.2609.401.0 is now in the Microsoft Store but Windows Update does not deliver it.
A fix for CVE-2026-83844 in Windows Paint is now available in the Microsoft Store as build 11.2609.401.0. The flaw is an out-of-bounds read that could allow remote code execution over the network. Microsoft rates it Important with CVSS 8.1. The fix was not known to be exploited when published. Newer builds remain available in some countries until Store auto-update applies.
Unconfirmed: How quickly other PCs will receive the fixed build is not yet clear
- Fixed build is 11.2609.401.0
- No Windows Update delivery
- Check via PowerShell Get-AppxPackage and Get-AppxProvisionedPackage
- Not in CISA KEV catalog
- No mitigation listed
Impact: remote code execution in Windows Paint
- 1.Update Paint through the Microsoft Store
- 2.Run PowerShell commands to check versions
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-83844 | Network RCE via out-of-bounds read in Windows Paint | 7.0 | <1% | PoC ×7 |
From the original article
3 min read at thehackernews.com
A fix for CVE-2026-83844, a remote code execution flaw in Windows Paint, is now in the Microsoft Store. Paint gets this fix only through a Store update, not through Windows updates. The fixed build, 11.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.