CVE-2026-83844 published October 13, 2026; administrator reports and coverage November 4 to 5, 2026
Microsoft Paint Has an 8.1 Remote Code Flaw, and Administrators Cannot Find the Fix the Guide Names
Microsoft published CVE-2026-83844 on October 13: an out-of-bounds read in Windows Paint, scored 8.1, with a network attack vector and no privileges required, under which a specially crafted image can potentially lead to code execution. Attack complexity is rated high, which tempers but does not remove the concern. The current story is the fix, or rather its whereabouts. Microsoft's Security Update Guide first listed Paint version 11.2605.91.0 as the fixed release, but administrators report that the Microsoft Store continued to offer the earlier 11.2605.81.0, including after manual update checks and store resets. The Guide now reportedly lists version 11.2609.401.0 as the fix, which raises the possibility that the first version number was an error; one commenter claims the patched build is available so far only in South Asian regions, consistent with a staggered rollout, but that claim is unverified. The result is a verification gap: the Store can report that Paint is up to date on a machine that does not carry the fix. Both reports covering the issue give the same working advice: check the installed version directly, keep checking the Store, and until the fixed build is present, consider restricting untrusted image files or removing Paint from systems that do not need it.
Executives
The risk here is modest software with an immodest lesson. A bundled drawing program carries a network-reachable code execution flaw, and for weeks the official record of its fix has pointed at a version administrators cannot obtain, while the update channel reports success. Treat this as a spot check on patch assurance generally: for any critical fix, does the organization verify the version running on endpoints, or does it trust the update tool's own report. Those are different controls, and this case shows the gap between them.
CIO / CISO
Do not close CVE-2026-83844 on the basis of Store update status. Closure evidence is the installed Paint version, collected from endpoints and compared against the version in Microsoft's Security Update Guide, with the Guide rechecked because the listed fixed version has already changed once. Where Paint is not needed, removal is the cleanest mitigation and is explicitly among the options the coverage suggests; where it is needed and the fix is absent, restrict handling of untrusted image files until the fixed build lands.
Engineers
Check the fleet with the command both reports cite: Get-AppxPackage Microsoft.Paint, and record Name and Version per device. A device reporting 11.2605.81.0 does not have the documented fix, whatever the Store says. Track which fixed version the Guide lists at the time you check, since 11.2605.91.0 and 11.2609.401.0 have both appeared, and keep the evidence with the ticket so a later auditor can see which target you verified against.
Everyone (non-IT)
If you use Windows 11, you can check your own Paint version in PowerShell with the command in this brief, and keep an eye on Store updates until it changes. Until then, be a little more careful than usual with image files from senders you do not know. If you never use Paint, removing it is a reasonable and simple step.