The Fix Is Out. Windows Update Won’t Deliver It.

Here is a patch story with a trap in it: the fix for a remote code execution flaw in Microsoft Paint exists, is sitting in the Microsoft Store right now — and Windows Update will never deliver it. If your fleet’s patch compliance runs on Windows Update scans alone, every dashboard can read “fully patched” while Paint stays vulnerable.

What happened

The flaw is CVE-2026-83844, an out-of-bounds read in Windows Paint that can let an attacker run code over the network — no sign-in, no victim interaction, just a specially crafted packet sent to an affected service. Microsoft rates it Important with a CVSS score of 8.1 and published it on October 13. At publication the flaw was not known to be exploited or publicly disclosed, and it has not landed in CISA’s Known Exploited Vulnerabilities catalog.

Paint is a Microsoft Store app, so its fix travels the Store road: build 11.2609.401.0. That build is now confirmed as the newest Paint version in all ten countries checked this week. Getting here was not tidy, though. Earlier this week, checks of the Store in six countries found the newest build on offer was 11.2605.81.0 — a version without the fix — meaning admins who went looking for the patch in good faith were handed the vulnerable build. One test machine has since updated itself through Store auto-update, but how quickly the fixed build reaches every PC is genuinely unclear.

There is also a paperwork snag worth knowing about. Microsoft’s security advisory names 11.2609.401.0 as the fixed build. The CVE record still describes Paint as affected only below 11.2605.91.0 — a lower number the advisory itself apparently carried until recently. A vulnerability scanner keyed to the CVE record will clear machines that the advisory’s own number would still flag. The build that satisfies both is 11.2609.401.0 or later, and that is the number to enforce.

Why this one matters

Store apps quietly break the mental model most patch programs are built on. Paint installs separately for each user account on a PC, and Windows can also keep a provisioned copy that gets installed for every new user who logs on. So “Paint is updated” is not one fact about a machine — it is one fact per user, plus one about a copy that may not have run yet. Check only the signed-in account and you can certify a fleet clean while older copies sit untouched under other profiles, waiting for their owners to open an image.

Microsoft lists no workaround and no mitigation for this flaw. Updating is the fix — or removing Paint entirely where nobody needs it, provisioned copy included.

What to do now

• Inventory every copy, not just yours. In an elevated PowerShell window run Get-AppxPackage -AllUsers -Name Microsoft.Paint to list each user’s installed build, and Get-AppxProvisionedPackage -Online | Where-Object DisplayName -eq 'Microsoft.Paint' for the provisioned copy. Any result below 11.2609.401.0 is unpatched.
• Push the Store update. Update Paint through the Microsoft Store on individual machines, and at fleet scale let the Store app update scan in Intune or your device-management tooling do it — that is the channel this fix actually travels.
• Verify against the advisory’s number. Re-run both commands after updating and confirm every copy shows 11.2609.401.0 or later. Do not accept a scanner’s “fixed” verdict alone if it is reading the CVE record’s lower threshold.
• Remove Paint where it isn’t needed. On machines with no legitimate use for it, uninstalling Paint — for all users and from the provisioned image — deletes the attack surface instead of maintaining it.

An 8.1-rated, no-interaction network flaw in an app that ships on effectively every Windows PC is not an emergency today — nothing says it is being exploited. But it is a perfect test of whether your patch program sees Store apps at all. Run the two commands on a sample of machines this week. If the numbers come back mixed, you have learned something important about your fleet — cheaply, and before someone less friendly runs the same check.