Microsoft releases fixed Paint build for remote code execution flaw, but only via Microsoft Store
Administrators must check each user's copy and any provisioned copy, because Windows Update will not deliver the fix.
Microsoft has released the fixed build 11.2609.401.0 of Windows Paint for CVE-2026-83844, a network-reachable remote code execution flaw rated Important with a CVSS score of 8.1. The patch is delivered only through the Microsoft Store rather than Windows Update, and a test by Brian Vitko of RFF found that the Store had offered an unfixed build as recently as earlier this week, while his own virtual machine later updated itself. The CVE record and NVD entry still list Paint as affected only below 11.2605.91.0, so scanners using that range could mark newer builds as fixed or vulnerable inconsistently. Administrators should check every user's copy and any provisioned copy with PowerShell, and update anything below 11.2609.401.0; Microsoft's advisory names no workaround, and the flaw was not in CISA's known-exploited catalog when checked.
Why it matters
Users of Windows Paint who rely on Windows Update will not receive the fix automatically, so the Microsoft Store is the only route to the patched build 11.2609.401.0. Paint can be installed per user and as a provisioned copy, so a check of the signed-in account alone can miss older copies still running a vulnerable version. The conflicting affected-version range in the CVE record and NVD entry adds uncertainty for anyone relying on vulnerability scanners to confirm which builds are safe.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.