Microsoft Paint RCE Flaw Fixed via Store Update Only
A critical remote code execution vulnerability in Windows Paint has been patched, but the fix bypasses traditional Windows Update mechanisms.
TL;DR
- CVE-2026-83844 is a high-severity RCE flaw in Windows Paint.
- The patch is available only through the Microsoft Store, not Windows Update.
- Affected users must manually update Paint to version 11.2609.401.0.
- The vulnerability involves an out-of-bounds read that can enable remote code execution.
- Organizations should verify Paint versions and apply the Store-based update immediately.
A newly discovered remote code execution (RCE) vulnerability in Windows Paint, tracked as CVE-2026-83844, has been addressed by Microsoft. However, organizations should note that the fix is only distributed through the Microsoft Store, bypassing standard Windows Update channels.
This unusual delivery method may delay patch adoption across enterprise environments where centralized update controls are in place. Security teams should take immediate action to ensure the updated Paint version—11.2609.401.0—is deployed across all affected systems.
Vulnerability Overview
- CVE-2026-83844 is classified as an out-of-bounds read vulnerability.
- It could allow attackers to execute arbitrary code remotely.
- Exploitation may occur when a user opens a malicious image file.
- Microsoft rated the vulnerability as high severity.
Patch Distribution Quirks
- The fix is only available via the Microsoft Store, not Windows Update.
- Version 11.2609.401.0 is confirmed as the patched release.
- Enterprise admins may need to adjust policies to allow Store-based updates.
- Manual verification of Paint versions is recommended for compliance teams.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.