Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

Microsoft Paint CVE-2026-83844 fix is in the Store, not Windows Update

5 sources · 5 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

A Microsoft Store build fixes Paint CVE-2026-83844; outlets disagree on remote versus local attacks and on the CVSS score.

Microsoft has made a Windows Paint fix for CVE-2026-83844 available in the Microsoft Store as build 11.2609.401.0, but The Hacker News reports Windows Update does not deliver it. The flaw is an out-of-bounds read (CWE-125). Cyber Security News and GBHackers describe unauthenticated remote code execution from crafted packets with no user interaction and a CVSS 8.1 score; Dark Reading says the bug needs local access and some user interaction and scores it 7.0. Microsoft has reported no known exploitation and rated exploitation less likely. Early reports listed build 11.2609.401.0 as affected, while later reports call that build the fix; Cyber Security News says NIST lists versions below 11.2605.91.0.

Key facts
  • CVE-2026-83844 is an out-of-bounds read in Windows Paint, tracked as CWE-125.
  • The Hacker News and Dark Reading identify Store build 11.2609.401.0 as the fix.
  • GBHackers reports CVSS 8.1 and temporal score 7.1; Dark Reading reports CVSS 7.0.
  • The Hacker News says the flaw is not in the CISA KEV catalog.
  • Version checks cited include Get-AppxPackage and Paint Settings, About.
Analyze CVE-2026-83844 with Vani AIImpact, affected versions, exploitation, mitigations and detection

What each outlet adds

beyond the shared facts
  • Dark ReadingSays local access and user interaction are required; CVSS 7.0.
  • The Hacker NewsFixed build is not delivered by Windows Update; not in CISA KEV.
  • GBHackersReports CVSS 8.1, temporal score 7.1, and unproven exploitation.
  • Cyber Security NewsTies disclosure to October 2026 Patch Tuesday and a NIST version cutoff.
  • SOCRadarNotes questions about how Microsoft Store updates are applied.
CVEs
CVE-2026-83844
Vendors
Microsoft
Products
PaintWindows Paint

Coverage

oldest first · one row per article · UTC
  1. · 6d ago Cyber Security NewsFirst report

    Microsoft discloses Paint RCE vulnerability

    Microsoft warns of out-of-bounds read in Paint (CWE-125) enabling unauthenticated remote code execution; users must update to build 11.2609.401.0 or later.

  2. · 6d ago GBHackers

    Microsoft Paint vulnerability enables remote code execution (CVE-2026-83844)

    An out-of-bounds read in Windows Paint build 11.2609.401.0 lets unauthenticated attackers execute code remotely without interaction.

  3. · 6d ago SOCRadar

    Microsoft Paint RCE CVE-2026-83844 raises store update questions

    A new CVE in Microsoft Paint has been disclosed, raising questions about store update processes.

  4. · 6d ago The Hacker News

    Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It

    Fixed build 11.2609.401.0 is now in the Microsoft Store but Windows Update does not deliver it.

  5. · 3d ago Dark Reading

    Microsoft patches Windows Paint local RCE flaw CVE-2026-83844

    The out-of-bounds read needs local access and user interaction; Microsoft rates exploitation less likely.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-83844
Network RCE via out-of-bounds read in Windows Paint
7.0<1%PoC ×8