A critical security update for Microsoft Paint, addressing a remote code execution vulnerability identified as CVE-2026-83844, has been released exclusively through the Microsoft Store. This patch, however, is not being distributed via the standard Windows Update process, which necessitates manual intervention by users to secure their systems.
Patch Details and Availability
The patched version, 11.2609.401.0, has been confirmed as the latest iteration of Paint available in the Microsoft Store across multiple countries. Despite the critical nature of this vulnerability, it is not being pushed through Windows Update, emphasizing the need for users to proactively install the update via the Store.
The vulnerability, characterized by an out-of-bounds read, permits potential attackers to execute arbitrary code over a network. This flaw has been rated as ‘Important’ by Microsoft, with a CVSS score of 8.1. It requires a sophisticated understanding of the target system to exploit, and as of its publication on October 13, there have been no known exploits or public disclosures.
Understanding the Update Process
Brian Vitko from RFF, a device-management software firm, conducted tests in various countries to verify the availability of the updated Paint version. Initially, he found the older build, 11.2605.81.0, without the security fix. However, his test system eventually auto-updated to the secure version, demonstrating the Store’s automatic update capability.
According to Microsoft’s advisory, the update to version 11.2609.401.0 is essential for addressing the vulnerability. The CVE record still lists the affected versions as those below 11.2605.91.0, suggesting that any version from 11.2605.91.0 onwards could be considered patched, though the most secure is the latest.
Ensuring Complete Protection
To check if all user accounts on a PC have the updated version of Paint, users can execute specific PowerShell commands. These commands will list the Paint version for each user account and any provisioned copies on the system. If any versions below 11.2609.401.0 are identified, it is crucial to update through the Microsoft Store.
No alternative mitigations or workarounds have been provided in the security advisory. Before the patch was available, Vitko had suggested uninstalling Paint if it was unnecessary for users, but this approach was not tested extensively.
Exploit Conditions and Current Status
The vulnerability could be exploited by sending a specially crafted packet to a susceptible service over the network, requiring no user authentication or interaction. Nevertheless, it has not been listed in the Known Exploited Vulnerabilities catalog maintained by the U.S. Cybersecurity and Infrastructure Security Agency as of the latest check.
In conclusion, while the update is currently only accessible through the Microsoft Store, ensuring all systems are updated to the secure version of Paint is critical for maintaining cybersecurity integrity. Users are advised to verify and apply the update promptly to protect against potential threats.
