Microsoft’s fixed Paint build for CVE-2026-83844, a remote code execution flaw, reached the Microsoft Store by 6th November, 2026 but Windows Update won’t install it. Admins also face a second problem: Microsoft’s own records disagree on which Paint build counts as fixed.
At a Glance
- Microsoft rates CVE-2026-83844 as Important, with a CVSS score of 8.1, and lists no workaround or mitigation.
- Paint build 11.2609.401.0 carries the fix, and it arrives only through Microsoft Store updates.
- The public CVE record and the NVD entry still mark only builds below 11.2605.91.0 as affected.
- Brian Vitko of RFF found an unfixed Paint build at the top of the Store in six countries earlier this week.
Paint’s fix arrived through Store auto-update
Brian Vitko, of device-management software maker RFF, queried the Store catalog for the US, UK, Germany, Australia, India and Singapore earlier this week. Every market returned 11.2605.81.0, a build without the fix. A Store update scan he ran as SYSTEM for four minutes left Paint where it was.
That changed overnight. His test virtual machine has since picked up 11.2609.401.0 on its own through Store auto-update, according to his updated write-up. Both the signed-in user and the provisioned copy moved. One machine proves the build is live; it says nothing about how fast the rest of a fleet will follow.
In a separate check by The Hacker News, 11.2609.401.0 was the newest Paint build in all ten countries tested. The flaw was also absent from CISA’s Known Exploited Vulnerabilities (KEV) catalog at the time of that check.
Microsoft’s records disagree on the fixed build
Microsoft’s security advisory names 11.2609.401.0 as the fixed build. The CVE record Microsoft also publishes lists Paint as affected only up to, but not including, 11.2605.91.0. The NVD entry carries the same range.
| Paint build | What the sources say |
|---|---|
| 11.2605.81.0 | Newest Store build in six countries earlier this week, no fix |
| 11.2605.91.0 | Fixed build in the CVE record and NVD, never found in the Store by admins |
| 11.2609.401.0 | Fixed build in Microsoft’s advisory, now live in the Store |
The middle number has an odd history. On 30th October, 2026, an admin asked on Microsoft Q&A where to find 11.2605.91.0, the build the advisory listed at the time. The newest version that admin could see was 11.2605.81.0, and 10+ other users flagged the same question. No Microsoft staff member has answered.
The advisory now points elsewhere, yet its revision history still shows only the original publication entry. Microsoft hasn’t explained the switch, and no public source shows that 11.2605.91.0 ever shipped through the Store.
The gap matters for anyone relying on a scanner. A tool that reads the CVE record would treat any build from 11.2605.91.0 upward as fixed, even though Microsoft’s advisory sets the bar higher. Only 11.2609.401.0 or later passes under both numbers.
Every user’s copy needs a check
Paint, like other Store apps, installs separately for each user account on a PC. Windows can also keep a provisioned copy that it installs for every new user, so checking only the signed-in account can miss older copies. Vitko’s write-up gives two commands for a PowerShell window opened as administrator.
The first lists every user’s copy:
Get-AppxPackage -AllUsers -Name Microsoft.Paint | Select-Object Version, @{ n = 'Users'; e = { $_.PackageUserInformation.UserSecurityId.Username -join ', ' } }
The second lists the provisioned copy:
Get-AppxProvisionedPackage -Online | Where-Object DisplayName -eq 'Microsoft.Paint' | Select-Object Version
For any copy below 11.2609.401.0, admins can work through these steps:
- Update Paint through the Store, or let Store auto-update install the fixed build.
- Run the Store app update scan in Intune or a similar device-management tool to cover many PCs at once.
- Rerun both commands and confirm every copy, including the provisioned one, reports 11.2609.401.0 or later.
- Set scanner rules to the advisory’s 11.2609.401.0 threshold until the CVE record catches up.
Before the fix reached the Store, Vitko suggested removing Paint wherever nobody needs it, for every user and from the provisioned copy. He never tested that step in his lab. His updated post says removal is no longer needed now that the Store carries the fix.
Microsoft’s advisory describes an attacker sending “a specially crafted packet to an affected service over the network,” without naming the service. The attack needs no sign-in and no user interaction, though Microsoft says success requires a deep understanding of the target system.
Microsoft listed the flaw as neither exploited nor publicly disclosed at release, and that label can age fast. CISA added the SharePoint RCE bug CVE-2026-45659 to its KEV catalog in July, after Microsoft had already patched it. For Paint, the checkpoint that counts is simple: every per-user and provisioned copy on a fleet reporting 11.2609.401.0.
