Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It
A security flaw has been identified in Microsoft Paint, providing enough detail for defenders to take action.
A security flaw has come to light in Microsoft Paint, with enough detail now public for defenders to act on it.
This requires local or already-authenticated access to reach.
A fix for CVE-2026-83844 , a remote code execution flaw in Windows Paint, is now in the Microsoft Store.
The fixed build, 11.2609.401.0, was the newest Paint build in all ten countries The Hacker News checked today.
The flaw was not known to be exploited or publicly disclosed when the company published it on October 13.
He found that the newest in each was 11.2605.81.0, a build without the fix.
Anyone running Microsoft Paint The advisory lists no workaround or mitigation is exposed, specifically wherever Microsoft Paint is actually deployed rather than just licensed or installed somewhere unused.
Microsoft rates it as Important, with a CVSS score of 8.1, and says that a successful attack requires a deep understanding of the target system.
Brian Vitko of RFF, a device-management software maker, checked which Paint builds the Store offered in six countries earlier this week.
What an attacker actually gains: successful exploitation allows the attacker to execute code with the permissions of the affected process.
The flaw is an out-of-bounds read that could let an attacker run code over a network.
The CVE record for the flaw, which the company also publishes, still lists Paint as affected only below 11.2605.91.0.
This is tracked as CVE-2026-83844 and rated high severity, which is the identifier to use when checking vendor guidance.
The affected versions are The advisory lists no workaround or mitigation, so that's the range to check against your own deployment.
So a scanner that reads the CVE record would treat any build from 11.2605.91.0 up as fixed.
A workaround exists, but there is no complete fix available yet.
Paint gets this fix only through a Store update, not through Windows updates.
His test virtual machine has since moved to the fixed build on its own, through Store auto-update.
Confirm whether Microsoft Paint The advisory lists no workaround or mitigation is present anywhere in your asset and software inventory.
No exploitation has been reported yet, but that status can change, so keep watching vendor guidance while you remediate.
A check of only the signed-in account can miss older copies.
What happened
A security flaw has been identified in Microsoft Paint, providing enough detail for defenders to take action.
This vulnerability requires local or already-authenticated access to be exploited.
A fix for CVE-2026-83844, a remote code execution flaw in Windows Paint, is now available in the Microsoft Store.
What changed
The fixed build, 11.2609.401.0, is the latest Paint version across all ten countries checked by The Hacker News.
At the time of its publication on October 13, the flaw was not known to have been exploited or publicly disclosed.
In each of the countries surveyed, the latest version available was 11.2605.81.0, which does not contain the fix.
Who is affected
Anyone using Microsoft Paint The advisory lists no workaround or mitigation is at risk, particularly in environments where Microsoft Paint is actively deployed.
Microsoft rates this issue as Important, assigning a CVSS score of 8.1, and states that a successful attack necessitates a deep understanding of the target system.
Brian Vitko of RFF, a device-management software maker, examined the Paint builds available in six countries earlier this week.
Why it matters
Successful exploitation allows an attacker to execute code with the permissions of the affected process.
The flaw involves an out-of-bounds read that could enable an attacker to run code over a network.
The CVE record for this flaw indicates that Paint is affected only below version 11.2605.91.0.
Technical details
This vulnerability is tracked as CVE-2026-83844 and rated high severity, which should be referenced for vendor guidance.
The affected versions are The advisory lists no workaround or mitigation, defining the range to verify against your own deployment.
Thus, a scanner referencing the CVE record would consider any build from 11.2605.91.0 and above as fixed.
Response
A workaround is available, but a complete fix has not yet been released.
Paint will receive this fix only through a Store update, not via Windows updates.
The test virtual machine has since updated to the fixed build automatically through the Store's auto-update feature.
What security teams should do
Verify whether Microsoft Paint The advisory lists no workaround or mitigation is present in your asset and software inventory.
While no exploitation has been reported, this status could change, so it is important to monitor vendor guidance during remediation.
Checking only the signed-in account may overlook older copies.