Windows Paint RCE fix (CVE-2026-83844) confirmed but not arriving via Microsoft Store updates

A patch exists but is not reaching devices

On October 13, Microsoft disclosed CVE-2026-83844, a remote code execution vulnerability in the built-in Windows Paint app. The Microsoft Security Response Center (MSRC) identifies version 11.2609.401.0 as the fixed release, and because Paint is managed as a standalone Microsoft Store app on Windows 11, that patch travels through the Store rather than through Windows Update.

According to the dev.to report, originally published by Japanese outlet Joho no Todai, that distribution is not happening reliably. On a physical Windows 11 machine with automatic Store updates enabled, Paint stayed on version 11.2603.251.0, and even a manual check for updates inside the Store offered nothing. Multiple IT administrators have independently reported that no update appears for them either.

The report also stresses that installing cumulative OS updates, including October's security rollup, does not necessarily bring Paint to a patched build, since the app moves on its own update channel.

The version number itself has added to the confusion. MSRC initially listed 11.2605.91.0 as the fixed version, and a question posted to Microsoft Q&A in late October noted that this build could not be found in the Store. The current MSRC page lists 11.2609.401.0 instead, which suggests the original figure was a typo. Anyone verifying an installation should rely on the current MSRC listing rather than numbers preserved in earlier coverage or forum threads.

Why the rollout has stalled is unknown. The report says it is unclear whether this reflects a phased rollout by region or Windows version, or an outright problem with distribution.

What the vulnerability involves

CVE-2026-83844 is classified as CWE-125, an out-of-bounds read in Paint. Successful exploitation could allow remote code execution.

Microsoft's CVSS v3.1 vector rates the attack vector as Network, attack complexity as High, privileges required as None, and user interaction as None, for a base score of 8.1. Microsoft's own severity rating is Important, one level below Critical.

MSRC's FAQ describes the attack scenario as an unauthenticated attacker sending specially crafted packets over a network to an affected service, potentially achieving code execution on the target system. However, as the report points out, no public information establishes how the ordinary Paint app would actually accept network input, so the real-world preconditions for an attack remain unclear despite the vector suggesting no user interaction is needed.

At the time of disclosure, no exploit code existed and no active exploitation had been confirmed. MSRC assesses exploitation as less likely, consistent with the high attack complexity rating.

How to check your system

Users can verify whether Paint is patched through the app's settings or via PowerShell:

Get-AppxPackage -Name Microsoft.Paint | Select-Object Name, Version

A displayed version of 11.2609.401.0 or later matches the fixed release MSRC currently lists. Anything older means manually checking the Microsoft Store library for updates; if no update is offered there either, the report concludes that waiting for distribution is currently the only option.

Organisations that control Store app updates through Group Policy or mobile device management should also confirm whether their policy settings are affecting delivery.

Why it matters

This is not an active incident: no exploits have been observed, and Microsoft itself considers exploitation unlikely given the high attack complexity. The story matters because it exposes a patching gap. When a vulnerability lives in a Store-managed app, "Microsoft has fixed it" does not mean "your device has it." October's Windows Update patches provide no signal about Paint's status, and Store auto-updates are demonstrably failing to deliver the build on some systems. For a network-vector flaw scored 8.1, the only dependable verification is checking the version number yourself, and until Microsoft explains or resolves the delay, that manual check is the entire remediation story for users and administrators.