Microsoft has released a security update addressing a high-severity remote code execution vulnerability in its Windows Paint application. However, users will not receive the fix through the regular Windows Update service and must instead obtain the updated version through the Microsoft Store.
The vulnerability, identified as CVE-2026-83844, could allow attackers to execute malicious code remotely under certain conditions. Microsoft has classified the security issue as Important, assigning it a CVSS severity score of 8.1.
The corrected version of Microsoft Paint is 11.2609.401.0, which was identified as the latest available release across all ten countries examined by The Hacker News.
The security weakness involves an out-of-bounds read vulnerability that could potentially be exploited to execute code over a network.
According to Microsoft’s security advisory, exploiting the flaw requires an attacker to have an advanced understanding of the targeted system.
When Microsoft published details of the vulnerability on October 13, 2026, there were no confirmed reports that it had been publicly disclosed or actively exploited by malicious actors.
However, concerns emerged after security investigations revealed that some users were still receiving older versions of Paint that did not contain the security correction.
Brian Vitko, an employee of RFF, a company specialising in device-management software, previously examined Microsoft Paint versions available through the Store in six different countries.
His investigation found that the newest version being offered in those locations was 11.2605.81.0, which did not include the required security fix.
Vitko’s findings raised questions about how quickly Microsoft was distributing the updated application to users across different regions.
His test virtual machine has since received the corrected version automatically through the Microsoft Store’s update mechanism. However, it remains unclear how quickly the update will reach other Windows computers.
Microsoft Paint Users Must Verify the Corrected Version
Microsoft’s security advisory identifies version 11.2609.401.0 as the corrected release for CVE-2026-83844.
However, the vulnerability’s official CVE record and the National Vulnerability Database (NVD) list a different version threshold, indicating that Paint installations below 11.2605.91.0 are affected.
This discrepancy could create confusion for organisations and security administrators relying on automated vulnerability-scanning systems to determine whether their computers have been protected.
According to the available records, security scanners using the CVE information may classify versions from 11.2605.91.0 onwards as unaffected.
Nevertheless, installing version 11.2609.401.0 or a later release provides the version explicitly identified in Microsoft’s security advisory as containing the fix.
The advisory previously listed version 11.2605.91.0 as the corrected release, according to a Microsoft Q&A discussion published the previous week.
However, its revision history did not provide an explanation for the change in the recommended version.
How to Check Whether Your Windows Paint Is Protected
Security experts have warned that checking only the Paint application installed for the currently signed-in Windows user may not provide a complete picture of a computer’s security status.
This is because Microsoft Paint, like other applications distributed through the Microsoft Store, can have separate installations for different user accounts.
Windows may also maintain a provisioned version of the application that is automatically installed when a new user account is created.
Consequently, an administrator who checks only one account could overlook outdated versions installed elsewhere on the computer.
Vitko recommended using two PowerShell commands to identify all installed copies of Microsoft Paint and check the provisioned application version.
The commands should be executed in an administrator-level PowerShell window.
The first command identifies Paint installations across all user accounts:
Get-AppxPackage -AllUsers -Name Microsoft.Paint | Select-Object Version, @{ n = 'Users'; e = { $_.PackageUserInformation.UserSecurityId.Username -join ', ' } }The second command checks the provisioned version of Paint:
Get-AppxProvisionedPackage -Online | Where-Object DisplayName -eq 'Microsoft.Paint' | Select-Object VersionAdministrators who discover installations running versions older than 11.2609.401.0 are advised to update the application through the Microsoft Store or allow its automatic update mechanism to install the corrected release.
Organisations managing multiple Windows computers can also use Microsoft Intune and other device-management platforms to initiate Microsoft Store application update scans across their systems.
After installing the update, administrators should run both PowerShell commands again to confirm that every installed and provisioned copy is running version 11.2609.401.0 or later.
Microsoft’s security advisory does not currently list a workaround or alternative mitigation for the vulnerability.
Before the corrected version became available through the Store, Vitko suggested that organisations that did not require Paint could consider removing the application from all user accounts and deleting its provisioned copy. However, he disclosed that he had not tested that particular removal procedure.
Vulnerability Does Not Require User Interaction
Microsoft’s advisory states that an attacker could exploit CVE-2026-83844 by transmitting a specially crafted network packet to an affected service.
The company did not identify the specific service involved in the advisory.
Notably, the attack does not require authentication or assistance from the targeted user, potentially increasing the security implications for vulnerable systems exposed to network-based attacks.
Despite its severity, the vulnerability was not listed in the Known Exploited Vulnerabilities catalogue maintained by the United States Cybersecurity and Infrastructure Security Agency (CISA) at the time of the report.
The development highlights the importance of keeping Microsoft Store applications updated independently of Windows system updates, as security fixes for individual applications may not necessarily arrive through the traditional Windows Update process.
Windows users and IT administrators are therefore advised to verify their Microsoft Paint installations and ensure that all copies have been upgraded to the corrected version.