A fix for CVE-2026-83844, a remote code execution flaw in Windows Paint, is now in the Microsoft Store. Paint gets this fix only through a Store update, not through Windows updates.
The fixed build, 11.2609.401.0, was the newest Paint build in all ten countries The Hacker News checked today.
The flaw is an out-of-bounds read that could let an attacker run code over a network. Microsoft rates it as Important, with a CVSS score of 8.1, and says that a successful attack requires a deep understanding of the target system. The flaw was not known to be exploited or publicly disclosed when the company published it on October 13.
Brian Vitko of RFF, a device-management software maker, checked which Paint builds the Store offered in six countries earlier this week. He found that the newest in each was 11.2605.81.0, a build without the fix.
His test virtual machine has since moved to the fixed build on its own, through Store auto-update. That is one machine, and how quickly other PCs will get the build is not yet clear.
Microsoft's security advisory names 11.2609.401.0 as the fixed build. The CVE record for the flaw, which the company also publishes, still lists Paint as affected only below 11.2605.91.0. Its NVD entry shows the same range.
So a scanner that reads the CVE record would treat any build from 11.2605.91.0 up as fixed. A copy at 11.2609.401.0 or later passes under both numbers.
0 as the fixed build, according to a forum question on Microsoft Q&A.
Source link
