Microsoft has released a fix for the CVE-2026-83844 vulnerability in Windows Paint, which allows remote execution of arbitrary code. The key point: the patch is distributed exclusively through the Microsoft Store, not via the usual Windows Update mechanism. This means the standard security update cycle will not close this hole — administrators must separately ensure that all copies of Paint on managed systems are updated to version 11.2609.401.0 or later.
Technical essence of the vulnerability
According to RFF research, CVE-2026-83844 is an out-of-bounds read error that Microsoft classifies as a remote code execution vulnerability. The entry in the NVD database and the Microsoft security advisory contain the official description of the vulnerability.
The situation around the severity rating and attack vector is contradictory. In the original advisory dated 13 October 2026, Microsoft specified a CVSS 8.1 score with a network attack vector and no requirement for user interaction. However, according to the updated RFF research, on 7 November 2026 Microsoft changed the rating to CVSS 7.0, indicating a local attack vector and a requirement for user interaction. This significantly changes the threat model: instead of a fully remote attack without victim involvement, it may be a scenario that requires certain actions from the user.
The description of the exploitation mechanism also remains unclear. The FAQ in the Microsoft advisory mentions a “specially crafted network packet sent to a vulnerable service”, but the specific service is not named, and the advisory contains no additional details. Neowin described a vector involving the opening of a specially crafted image, but this scenario is not confirmed by the Microsoft advisory.
Version confusion and risks for scanners
The patch story was accompanied by serious confusion over version numbers, which creates real problems for automated vulnerability management.
Initially, the Microsoft advisory named version 11.2605.91.0 as fixed. However, as follows from a question on Microsoft Q&A, this version was not available in Microsoft Store — the store offered only the older build 11.2605.81.0. Later, Microsoft updated the advisory, listing 11.2609.401.0 as the fixed version, but without noting this change in the revision history.
According to RFF’s research, the CVE record was later also updated and now lists versions below 11.2609.401.0 as vulnerable. However, at the time the research was published, the NVD entry was still in the “Undergoing Analysis” status without configuration of affected versions. This means that vulnerability scanners that rely on NVD data may mistakenly consider vulnerable systems to be protected. Administrators should check Paint versions manually, rather than relying solely on automated tools.
Specifics of verification and updating
Applications from Microsoft Store are installed separately for each user account. In addition, Windows stores a so-called “provisioned” copy, which is automatically installed for every new user. Checking only the current account may miss vulnerable copies of Paint for other users of the system.
To fully check all copies of Paint, run the following two commands in PowerShell with administrative privileges:
Checking copies for all users:
Get-AppxPackage -AllUsers -Name Microsoft.Paint | Select-Object Version, @{ n = 'Users'; e = { $_.PackageUserInformation.UserSecurityId.Username -join ', ' } }
Checking the provisioned copy:
Get-AppxProvisionedPackage -Online | Where-Object DisplayName -eq 'Microsoft.Paint' | Select-Object Version
The -AllUsers parameter is critically important: without it, the command will show only the current user’s copy.
Remediation recommendations
- Update Paint via Microsoft Store to version 11.2609.401.0 or later. In environments with Intune or similar device management tools, use the mechanism for scanning updates of Store applications.
- After updating, run both PowerShell commands again and make sure that all copies — for each user and the provisioned one — are updated.
- Do not rely on automated vulnerability scanners as the only indicator: NVD data may be incomplete.
- If Paint is not used on workstations, consider removing it for all users and from the provisioned package as an additional measure to reduce the attack surface.
We previously covered the October Microsoft update cycle in the article Patch Tuesday October 2026, within which the initial advisory for CVE-2026-83844 was published.
The main practical takeaway: the standard Windows update process does not close this vulnerability. Administrators of corporate environments need to separately check Paint versions on all managed systems using the PowerShell commands provided and, if necessary, initiate an update via Microsoft Store or device management tools.
