A Windows RCE Fix That Lives in the Store
A fix for CVE-2026-83844, a remote code execution flaw in Windows Paint, is now available. It is delivered only through a Microsoft Store update. Windows Update and standard patch-management channels will not deliver it, so fleets that rely on them can stay exposed.
Vulnerability Details
| Item | Detail |
|---|---|
| CVE | CVE-2026-83844 |
| Type | Out-of-bounds read leading to remote code execution |
| Severity | Important, CVSS 8.1 |
| Published | October 13, 2026 |
| Exploited in the wild | Not known at publication; not in CISA KEV when checked |
| Attribution | None reported |
Microsoft's advisory says an attacker could send "a specially crafted packet to an affected service over the network". It does not name the service. No sign-in or user interaction is required.
Conflicting Version Information
The sources disagree on what counts as fixed:
- The CVE record and NVD entry list Paint as affected below 11.2605.91.0.
- Microsoft's advisory names 11.2609.401.0 as the fixed build.
- A Microsoft Q&A post gave 11.2605.91.0 as the fixed build, and the advisory's revision history does not mention a change.
Any copy at 11.2609.401.0 or later passes under both numbers. Researcher Brian Vitko found the newest Store build in six countries was 11.2605.81.0, which lacks the fix. In the ten countries The Hacker News checked, the newest build was 11.2609.401.0, so regional rollout may vary.
Recommended Actions
- Inventory every Paint copy. List each user's installed copy and the provisioned copy on each machine. Vitko's write-up has two administrator PowerShell commands for this.
- Update through the Microsoft Store any copy below 11.2609.401.0, then rerun the inventory to confirm.
- Consider removing Paint where nobody needs it, from all users and from the provisioned image. Vitko suggested this but did not test it, and the advisory lists no official workaround.
- Close the patch-tooling gap. Store-delivered apps often fall outside WSUS, Intune update rings, and Windows Update compliance reports. Add explicit Store app version checks to your vulnerability scans.
Why It Matters
Because the fix is outside Windows Update, a fully patched Windows device can still run a vulnerable Paint build. Compliance dashboards built on Windows Update data would report such a device as healthy.