Windows Update Won't Fix This Paint Flaw (CVE-2026-83844)

Last checked: Nov 6, 2026. Based on Microsoft Security Update Guide, The Hacker News, NCSC.nl, and security researcher reports.

A vulnerability in Windows Paint could allow attackers to execute code on your PC, but Windows Update won't deliver the fix. Here's why and how to patch it.

#What is CVE-2026-83844?

CVE-2026-83844 is an out-of-bounds-read vulnerability in Microsoft Windows Paint that could allow remote code execution. Microsoft published the advisory on October 13, 2026, rating it Important with a CVSS 3.1 base score of 8.1.

#Attack vector and complexity

According to Microsoft's Security Update Guide:

• Attack vector: Network
• Attack complexity: High
• Privileges required: None

Microsoft notes that "a successful attack needs a deep understanding of the target," according to The Hacker News reporting on November 6, 2026.

#Exploitation status

As of November 6, 2026:

• Not known to be exploited at the time Microsoft published the advisory on October 13, 2026
• Not publicly disclosed when the advisory was published
• Not in CISA KEV (Known Exploited Vulnerabilities) when The Hacker News checked on November 6, 2026
• No active abuse reported by NCSC.nl as of November 6, 2026

#Why Windows Update won't fix it

Paint used to be a built-in Windows component. It's now a Microsoft Store app. Windows Update patches the operating system and built-in components, but it does not update Store apps.

That means running Windows Update will not patch CVE-2026-83844, even if Windows reports your system is fully updated.

#How to check and update Paint

#Check your version in Microsoft Store

1. Open Microsoft Store
2. Search for Paint
3. Click Update if available

#Check your version with PowerShell

Run this command in PowerShell:

Get-AppxPackage Microsoft.Paint | Select-Object Name, Version

The output shows your current Paint version. You need version 11.2609.401.0 or later.

#For multi-user PCs

On a PC with multiple user accounts, check Paint for all users. According to The Hacker News and RFF reporting, you should also check the provisioned package:

Get-AppxPackage -AllUsers Microsoft.Paint | Select-Object Name, Version
Get-AppxProvisionedPackage -Online | Where-Object DisplayName -like "*Microsoft.Paint*"

Update Paint separately for each user account, or remove and reinstall Paint from the Store to update the provisioned package.

#Version confusion: 11.2605.91.0 vs 11.2609.401.0

The CVE record originally listed version 11.2605.91.0 as the fixed version. However, security researchers and reporting from The Hacker News and RFF indicate the correct fixed version is 11.2609.401.0.

Use 11.2609.401.0 or later as the target version when verifying your patch status.

#What the vulnerability allows

The vulnerability is an out-of-bounds-read, which could allow an attacker to:

• Read memory contents outside the intended buffer
• Potentially execute arbitrary code
• Gain control of the affected system

The High attack complexity means exploiting this flaw requires significant technical skill and understanding of the target system. It is not a simple point-and-click exploit.

#What to do

1. Open Microsoft Store and search for Paint
2. Click Update to install version 11.2609.401.0 or later
3. Verify the update with PowerShell if you manage multiple PCs or user accounts
4. Do not rely on Windows Update to deliver this fix

If you don't use Paint, you can uninstall it from Settings, Apps, Installed apps.

#Sources

All facts in this article come from the following sources:

• Microsoft Security Update Guide, CVE-2026-83844
• The Hacker News, "Microsoft Paint RCE Fix Now Available Only via Microsoft Store" (Nov 6, 2026)
• NCSC.nl, "Kwetsbaarheid in Microsoft Windows Paint met risico op misbruik" (Nov 6, 2026)
• Neowin, "Microsoft Paint CVE-2026-83844 lets hackers hack Windows 11 PCs over internet" (Nov 4, 2026)
• RFF / Brian Vitko, "Windows Paint CVE-2026-83844: Store Fix Missing" (Nov 4-6, 2026)

#Keep your data off data brokers

Security patches protect your PC. Data broker removal protects your identity.

UndoLeak erases your data from data brokers and keeps it off.

Run a free scan to see where your information is listed right now.

---

Not affiliated with Microsoft.