Overview
Microsoft disclosed CVE-2026-83844, a remote code execution vulnerability in the Windows 11 Paint app, on October 13, 2026. Weeks of unclear messaging about how and whether it had been patched followed. This is a follow-up to our earlier coverage of the Store-delivered fix.
The Vulnerability
- Weakness: CWE-125, out-of-bounds read
- Rating: Important; initially CVSS 8.1
- Status at disclosure: not publicly disclosed or known to be exploited, and rated "exploitation less likely"
- Delivery: the fix ships through a Microsoft Store update to Paint, not through Windows Update
Where the Confusion Came From
- The CVE and NVD records initially listed Paint as affected only below build 11.2605.91.0, while Microsoft's advisory named 11.2609.401.0 as the fixed build. One source says admins never found 11.2605.91.0 in the Store.
- On November 6, Microsoft added a revision note confirming 11.2609.401.0 as the fixing build, and the CVE record now uses that cutoff.
- Revision 2.1 on November 7 lowered the score from 8.1 to 7.0, changed the attack vector to local with user interaction required, and reworded the description to local code execution. A new FAQ explains that "remote" refers to the attacker's location. Earlier coverage had suggested no clicks or authentication were needed.
Vulnerability scanners that relied on the earlier version range may have misreported exposure.
Recommendations
- Verify Paint is at build 11.2609.401.0 or later. Do not assume Windows Update delivered it.
- Where the Microsoft Store is blocked or managed, deploy the Paint update through your app-management tooling.
- Re-scan after the corrected CVE record propagates, and rule out stale findings in your scanner.
- Treat files opened in Paint from untrusted sources with caution until updated.