Skip to content
Hacker Posts

Microsoft Paint RCE fix (CVE-2026-83844) ships via Store, not Windows Update

CVE-2026-83844, an 8.1 out-of-bounds read in Windows Paint, allows network RCE. The patch reaches machines only through the Microsoft Store, so WSUS/Windows Update won't deliver it.

Published 3 min read
cvemicrosoftrcewindows

Microsoft patched a remote-code-execution flaw in Windows Paint, but the fix does not travel through Windows Update. CVE-2026-83844 is delivered only as a Microsoft Store app update — which means the patch-management pipeline most organizations rely on, including WSUS, will not push it. If you track patch state through Windows Update alone, Paint is a blind spot.

The flaw

Per Microsoft's Security Update Guide entry, the bug is an out-of-bounds read that can lead to remote code execution. Microsoft rates it Important, CVSS 8.1, vector AV:N/AC:H/PR:N/UI:N — network-reachable, high attack complexity, no privileges and no user interaction required. The advisory describes an attacker sending "a specially crafted packet to an affected service over the network" but does not name the service, and says a successful attack needs a deep understanding of the target.

As of publication the flaw is not in CISA's KEV catalog and there is no report of exploitation or public disclosure. Microsoft published the advisory on October 13, 2026.

Affected versions

  • Windows Paint builds 11.0.0.0 up to (not including) 11.2605.91.0 (CVE record).
  • Fixed build: 11.2609.401.0.

The delivery problem

Paint is a Store-provisioned app on current Windows, so its security updates come from the Microsoft Store, not the monthly cumulative update. The practitioner angle, surfaced by The Hacker News: Brian Vitko of RFF checked which Paint build the Store served across ten countries and found several still offering 11.2605.81.0 — below the fixed build — days after the advisory. Store auto-update moved at least one test machine to the fixed build, but the rollout timing is opaque and there is no listed workaround.

Action checklist

  1. Inventory Paint's version on your fleet: Get-AppxPackage *Paint* | Select Name, Version. Anything below 11.2609.401.0 is unpatched.
  2. Force the update where you can: winget upgrade "Microsoft.Paint", or trigger a Store app update via Get-CimInstance -Namespace root\cimv2\mdm\dmmap -ClassName MDM_EnterpriseModernAppManagement_AppManagement01 | Invoke-CimMethod -MethodName UpdateScanMethod.
  3. On managed estates, confirm the Microsoft Store (and Store app updates) isn't disabled by policy — if it is, these apps never patch.
  4. Where Paint isn't needed, remove it: Get-AppxPackage *Paint* | Remove-AppxPackage.

Context

This is the recurring cost of the inbox/Store split: a chunk of the Windows attack surface — Paint, Photos, Notepad, Terminal and the rest of the inbox-app set — patches on a channel that most vulnerability and patch-compliance tooling still treats as out of scope. CVE-2026-83844 isn't a crisis on its own (high complexity, no known exploitation), but it's a clean reminder to put Store app versions in the same reporting pane as your cumulative-update compliance.

Related stories