Microsoft Paint RCE (CVE-2026-83844): The Fix Windows Update Misses

A fix for CVE-2026-83844 — a remote code execution flaw in Windows Paint — is live in the Microsoft Store. Paint gets this fix only through a Store update; Windows Update does not deliver it. The fixed build is 11.2609.401.0.

The flaw is an out-of-bounds read that could let an attacker run code over a network. Microsoft rates it Important, CVSS 8.1, requiring deep understanding of the target system. It was not known to be exploited or publicly disclosed when published on October 13 — and was still not in CISA's Known Exploited Vulnerabilities catalog when checked earlier this week.

Two Numbers, One Trap

Vitko's test write-up gives two PowerShell commands (run as administrator, elevated) to list every user's copy of Paint and the provisioned copy:

So a fleet can measure "fixed" by scanner while shipping unfixed builds. The only safe target per the advisory is 11.2609.401.0 or later.

Check Every Copy, Not Just Yours

Paint — like other Store apps — is installed per user, and Windows keeps a provisioned copy it installs for each new user. Checking only the signed-in account misses older copies. Brian Vitko's test write-up gives two PowerShell commands (run as administrator) to list every copy and the provisioned image:

• Get-AppxPackage -AllUsers -Name Microsoft.Paint | Select-Object Version, …
• Get-AppxProvisionedPackage -Online | Where-Object DisplayName -eq 'Microsoft.Paint'

For any copy below 11.2609.401.0: update through the Store (or Intune's Store app update scan), then re-run both commands and confirm every copy shows the fixed build.

The advisory lists no workaround. Before the fix reached the Store, Vitko suggested removing Paint where nobody needs it — untested, but directionally sound in fleets where Paint is genuinely unused.

Attack Conditions

An attacker could exploit the flaw by sending "a specially crafted packet to an affected service over the network," Microsoft says, without naming the service. The attack requires no sign-in and no user assistance. A TestVM running Vitko's check has since auto-updated to the fixed build via Store auto-update — one machine, not a fleet.

Making the Fleet Measure What Counts

The lesson is process, not one CVE. Store apps live outside Windows Update's cadence, so PE management must cover them as first-class citizens: weekly Store update scans via Intune, app protection policy exceptions reviewed quarterly, and a scanner rule that checks the advisory's fixed build rather than the CVE record's stale one. The Paint case proves two registries can disagree for weeks; the fleet's measurement tool must follow the advisory, not the aggregator. Teams that vendor and provision images should bake the check into the golden image pipeline, not discover it after a network scan.

Sources

• The Hacker News coverage
• MSRC Advisory CVE-2026-83844
• NVD entry CVE-2026-83844
• Vitko's test write-up