A remote code execution vulnerability has been confirmed in Windows' built-in Paint app. Microsoft lists a fixed version, but tests have found systems still running older versions even with automatic Microsoft Store updates enabled.
Key points
- What happened: Paint vulnerability CVE-2026-83844 has been confirmed with a CVSS score of 8.1, and Microsoft lists 11.2609.401.0 as the fixed version
- Why it matters: Multiple reports based on actual checks show that the fix has not arrived even with automatic Microsoft Store updates enabled
- What to watch: Users need to check their Paint version separately from Windows Update; until the fix arrives, this remains the only way to verify its status
The fix is available but is not arriving
On October 13, Microsoft disclosed Paint vulnerability CVE-2026-83844. The Microsoft Security Response Center, or MSRC, page lists 11.2609.401.0 as the fixed version. It is distributed through Microsoft Store, separately from Windows Update.
However, systems have been identified where this fixed version has not actually arrived through the Store.
In one test on a physical Windows 11 system with automatic Microsoft Store updates enabled, Paint remained at version 11.2603.251.0. Manually checking for Paint updates in the Store reportedly did not offer an update either. Multiple IT administrators have also reported that no update appears in the Store.
On Windows 11, Paint is managed as a standalone Store app (in Japanese). Installing cumulative OS updates, including October's security update, does not necessarily update Paint to a fixed version.
The fixed version number itself has also caused confusion. MSRC reportedly initially listed 11.2605.91.0, and a question posted to Microsoft Q&A in late October said that version could not be found in the Store. The current MSRC page lists 11.2609.401.0, suggesting the original number may have been a typo. When checking for the fixed version, users need to consult MSRC's current listing rather than numbers preserved in earlier reporting or questions.
The reason for the distribution delay has not been identified. It is unclear whether this reflects a phased rollout by region or Windows version, or a problem with distribution itself.
What the vulnerability involves
CVE-2026-83844 is classified as CWE-125, an out-of-bounds read in Paint. Successful exploitation could allow remote code execution.
Microsoft's published CVSS vector rates the attack vector as Network, attack complexity as High, privileges required as None, and user interaction as None. The CVSS v3.1 base score reaches 8.1. Microsoft's severity rating is Important, one level below Critical.
MSRC's FAQ describes the attack scenario as follows.
An unauthenticated attacker could exploit this vulnerability by sending specially crafted packets over a network to an affected service. Successful exploitation could allow code execution on the target system.
However, public information does not establish the specific path through which the normal Paint app would accept network input. Although the CVSS vector rates user interaction as unnecessary, this explanation alone does not establish the conditions required for an attack in practice.
For exploitation risk, MSRC sets attack complexity to High and assesses exploitation as less likely. At disclosure, no exploit code existed and no active exploitation had been confirmed.
Checking and responding
Users can check whether Paint is fixed through the app's settings or PowerShell.
In PowerShell, run the following command.
Get-AppxPackage -Name Microsoft.Paint | Select-Object Name, Version
A displayed version of 11.2609.401.0 or later meets MSRC's listed fixed version. If an older version appears, manually check for updates through the Microsoft Store library. If no update is offered even then, users currently have to wait for the fixed version to be distributed.
Organizations managing endpoints may control Microsoft Store app updates through Group Policy or mobile device management, or MDM. In that case, whether policy settings affect Store update distribution also needs to be checked.
Given the high attack complexity and lack of observed exploitation, this is not a situation of immediately spreading harm. Even so, Microsoft lists a fixed version that is not reaching users' devices. Trusting automatic updates alone does not guarantee that the fix is installed. Checking the version remains the only verification step users themselves can take while waiting for the fixed version to be distributed.
Originally published on Joho no Todai. The Japanese original is here.
