Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It Swati KhandelwalNov 06, 2026Vulnerability / Windows Security A fix for CVE-2026-83844, a remote code execution flaw in Windows Paint, is now in the Microsoft Store. Paint gets this fix only through a Store update, not through Windows updates. The fixed build, 11.2609.401.0, was the newest Paint build in all ten countries The Hacker News checked today. The flaw is an out-of-bounds read that could let an attacker run code over a network. Microsoft rates it as Important, with a CVSS score of 8.1, and says that a successful attack requires a deep understanding of the target system. The flaw was not known to be exploited or publicly disclosed when the company published it on October 13. Brian Vitko of RFF, a device-management software maker, checked which Paint builds the Store offered in six countries earlier this week. He found that the newest in each was 11.2605.81.0, a build without the fix. His test virtual machine has since moved to the fixed build on its own, through Store auto-update. That is one machine, and how quickly other PCs will get the build is not yet clear. Microsoft's security advisory names 11.2609.401.0 as the fixed build. The CVE record for the flaw, which the company also publishes, still lists Paint as affected only below 11.2605.91.0. Its NVD entry shows the same range. So a scanner that reads the CVE record would treat any build from 11.2605.91.0 up as fixed. A copy at 11.2609.401.0 or later passes under both numbers. As recently as last week, the advisory gave 11.2605.91.0 as the fixed build, according to a forum question on Microsoft Q&A. The advisory's revision history still shows only its October 13 entry, with no note about the change. Paint, like other Store apps, is installed separately for each user account on a PC. Windows can also keep a provisioned copy that it installs for each new user. A check of only the signed-in account can miss older copies. Vitko's test write-up gives two commands to run in a PowerShell window opened as administrator. The first lists every user's copy of Paint, and the second lists the provisioned copy. Get-AppxPackage -AllUsers -Name Microsoft.Paint | Select-Object Version, @{ n = 'Users'; e = { $_.PackageUserInformation.UserSecurityId.Username -join ', ' } } Get-AppxProvisionedPackage -Online | Where-Object DisplayName -eq 'Microsoft.Paint' | Select-Object Version Update Paint through the Store, or let the Store auto-update install the fixed build. In Intune and other device-management tools, the Store app update scan does this across many PCs. Run both commands again and check that every copy shows 11.2609.401.0 or later. The advisory lists no workaround or mitigation. Before the fix reached the Store, Vitko suggested removing Paint where nobody needs it, for every user and from the provisioned copy. He did not test that step. Attack Conditions and Exploitation Status An attacker could exploit the flaw by sending "a specially crafted packet to an affected service over the network," the advisory says, but it does not name the service. The attack would require no sign-in and no user assistance. The flaw was not in the Known Exploited Vulnerabilities catalog run by the U.S. Cybersecurity and Infrastructure Security Agency when The Hacker News checked today. The catalog was last updated earlier this week. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. Microsoft, Patch Management, remote code execution, Vulnerability, Windows Security CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them AI-Generated Fake Login Pages Are Making Account Takeovers Easier Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Reserve My Spot Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. The 2026 Identity Crisis: Why Your IAM is Only Half the Story Stop driving blind. See the identity blind spots traditional IAM misses. Watch now. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk Your Attack Surface Is Growing Faster Than Your Team Can Respond The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll Why Root and Jailbreak Detection Alone Cannot Guarantee Mobile App Security