Microsoft’s fix for CVE-2026-83844, a code execution flaw in Windows 11 Paint, arrives only through the Microsoft Store, so October’s cumulative updates do not include it. Over the past week Microsoft has also changed the fixed build number and cut the severity score, which leaves many patch dashboards showing the wrong answer.
What happened
Microsoft first disclosed CVE-2026-83844 on 13 October 2026, as part of that month’s Patch Tuesday release. It is an out-of-bounds read in the Windows Paint app that Microsoft classes as Important, with remote code execution as the impact. It has caused confusion ever since.
Paint on Windows 11 is a Microsoft Store app, not a component of the operating system. Its security fixes therefore never appear in the monthly cumulative update. A machine that installed every October update through Windows Update, WSUS or Intune’s update rings can still be running a vulnerable Paint. Windows Latest reported on 5 November that its author’s PC had automatic Store updates switched on yet stayed on build 11.2603.251.0, well behind the fix. Administrators on Reddit described the same thing, even when they tried to fetch the package by hand.
The build number was the second problem. According to The Hacker News and Techzine, the Security Update Guide originally named 11.2605.91.0 as the first safe version. Store users were being offered 11.2605.81.0, which falls below that line. Microsoft’s entry now says the fix is in 11.2609.401.0. Techzine reported the new number on 5 November, yet The Hacker News found no revision note about it on 6 November. Microsoft’s revision history now records the change as version 2 of the advisory, dated 6 November. Microsoft says it released “a new version of Paint” to fully address the flaw. The Hacker News reported that the public CVE and NVD records still treat anything below 11.2605.91.0 as affected. Scanners that rely on those records may therefore mark machines as patched when, by Microsoft’s current definition, they are not.
Then, on 7 November, Microsoft published revision 2.1. Microsoft calls it an informational change, but it brought a new FAQ and a revised CVSS score.
The technical picture
The rescoring matters more than the “informational” label suggests. Early coverage, including The Hacker News and Windows Latest, quoted a CVSS 3.1 score of 8.1 with a network attack vector, no privileges and no user interaction. That made the bug sound like a zero-click remote attack. Windows Latest called it “no-click”. Microsoft’s own wording didn’t help: it talked about a crafted packet sent to an unnamed service over the network.
The live MSRC record now gives a base score of 7.0, with the vector AV:L/AC:H/PR:N/UI:R. In plain terms:
- Attack vector: local. The vulnerable code runs on the victim’s own machine.
- User interaction: required. Someone has to open something.
- Attack complexity: high. Microsoft says success depends on the environment, the configuration and any other defences in place.
- Impact: high for confidentiality, integrity and availability if it works.
The new FAQ explains that “remote” in the title refers to where the attacker sits, not to how the code is reached. Microsoft’s example is a victim who is persuaded to download and open a crafted file. For an image editor, that means a malicious image file arriving by email, chat or a download link and being opened in Paint. Techzine described the bug the same way.
Microsoft says the flaw has not been publicly disclosed or exploited, rates it “Exploitation Less Likely”, and lists no workaround. It is not in CISA’s Known Exploited Vulnerabilities catalogue.
Why it matters for UK organisations
The lower score is good news, but it doesn’t make this something to ignore. A local, user-triggered code execution bug in an app that ships on every Windows 11 desktop is exactly the sort of thing that turns up in phishing chains. That is especially true now that Windows 10 has reached end of support and most UK desktop estates have moved to Windows 11.
The bigger lesson is about how patch compliance gets measured. Many UK organisations report patch status to their boards, insurers and Cyber Essentials assessors using Windows Update compliance or a vulnerability scanner. Neither measure covers this fix reliably. Paint updates come only through the Store, and the build number that defines “fixed” has moved under everyone’s feet. Under the Cyber Essentials security update control, high and critical fixes must be applied within 14 days of release. Organisations that block the Microsoft Store as a hardening measure, which is a common choice in tightly managed estates, may never receive the new build unless they deliver it some other way.
Expert view
In my experience, the dangerous gaps in a patching programme are rarely the famous CVEs. They are the components nobody owns. On build reviews we regularly find Store apps and app packages provisioned for new users sitting months behind, because the team that owns Windows Update assumes the endpoint team handles apps, and the endpoint team assumes the reverse. CVE-2026-83844 falls straight into that gap.
I’d also caution against relying on the first CVSS score. The 8.1 network rating got this bug a lot of urgent coverage. The revised 7.0 local rating is more believable for a file-parsing bug in an image editor. Even so, the fixed build appears to have changed before any revision note was added, and Microsoft has not explained what was wrong with the original build number or score. Security teams should read the vector, not just the number, and recheck vendor advisories before closing tickets.
Finally, removing Paint where people don’t need it is a reasonable idea, but The Hacker News notes that Brian Vitko of RFF, who suggested it, had not tested the step. Try it on a pilot group first and make sure you remove the provisioned package as well as each user’s installed copy.
What to do now
- Measure the real version. Use PowerShell or your endpoint management tool to list the Microsoft.Paint package for every user profile and the provisioned image. Treat anything below 11.2609.401.0 as vulnerable, whatever your scanner says.
- Push the Store build deliberately. Where the Store is blocked, deploy the updated package through Intune’s Store app integration or your software distribution tool rather than waiting for automatic updates.
- Fix your scanner logic. If your vulnerability management tool uses the NVD version range, add a custom check for 11.2609.401.0 until the public records are corrected.
- Reduce exposure meanwhile. Consider uninstalling Paint on systems that don’t need it, after testing. Tighten mail and web filtering for image attachments from outside the organisation. This fits the Cyber Essentials secure configuration and malware protection controls.
- Close the ownership gap. Name someone responsible for Store and inbox apps in your patch management process, and include them in monthly compliance reporting.
Bottom line
CVE-2026-83844 is not an emergency. Microsoft now rates it as a local, user-triggered bug with no known exploitation. It still exposes a weakness in how many UK organisations prove they have patched. If your evidence comes only from Windows Update, check Paint by hand this week and fix whatever process let it slip through.
Sources
- Microsoft Security Response Center: CVE-2026-83844 Windows Paint Remote Code Execution Vulnerability
- The Hacker News: Microsoft Paint RCE Fix Now Available, but Windows Update Won’t Deliver It
- Techzine Global: Paint vulnerability allows RCE, patch is hard to find
- Windows Latest: Windows 11’s Paint has a no-click hacking bug, and even with auto-updates on you may not have the fix
