Microsoft advisory revised November 6, 2026; CVE-2026-83844 first published October 13, 2026
The Missing Fix Is in the Store Now: Paint Build 11.2609.401.0 Closes the 8.1 Flaw Windows Update Will Not Deliver
The open item from the November 5 edition is closed. CVE-2026-83844, an out-of-bounds read in Windows Paint that Microsoft classes as remote code execution at CVSS 8.1, had a named fixed build that administrators could not find anywhere; that changed on November 6. The RFF catalog checks that had returned 11.2605.81.0 as the newest Paint build in six markets on November 5 returned 11.2609.401.0 for the United States, the United Kingdom and Germany at 04:14 UTC on November 6, a test machine took the fixed build through Store auto-update on its own, and The Hacker News found 11.2609.401.0 the newest build in all ten countries it checked that day. Microsoft revised its advisory the same day to confirm that build as the fix. Delivery is the trap that remains: Paint is a Microsoft Store app, so the fix never arrives through Windows Update or a cumulative patch; it arrives only through a Store update, and Microsoft marks the flaw Customer Action Required. The second trap is measurement. The public CVE record and its NVD entry still list Paint as affected only below 11.2605.91.0, the build named at publication on October 13 that never appeared in the Store, so a scanner reading the CVE record will call builds fixed that the advisory does not; only 11.2609.401.0 or later passes under both numbers. The flaw itself needs no sign-in and no user interaction, carries high attack complexity, and Microsoft says a successful attack requires a deep understanding of the target system, by sending a specially crafted packet to an affected service the advisory does not name. It was not known to be exploited or publicly disclosed at publication and was not in the CISA Known Exploited Vulnerabilities catalog when checked on November 6. The advisory lists no workaround, so updating every copy, per user and the provisioned copy that new profiles receive, is the whole remediation.
Executives
A fully patched fleet can still carry this flaw, because the patching system most organizations trust, Windows Update, never touches the application involved. The executive question is therefore about coverage, not effort: who owns Store app updates in your environment, and can anyone prove, by build number, that Paint is at 11.2609.401.0 or later on every user copy, not only on the machines someone checked. Treat the scanner disagreement as part of the report you ask for, since tools reading the CVE record will understate what remains.
CIO / CISO
Close this by the advisory number, not the CVE record number: 11.2609.401.0 is the fixed build, and anything below it, including the 11.2605.91.0 the CVE record names, stays on the open list. Push the Store update scan through your device management tooling, verify per user and provisioned copies separately, and record the evidence as build inventories rather than patch compliance percentages. Keep the status language accurate in the ticket: severity driven, not exploited, not in the KEV catalog, no workaround available, remediation is the Store update alone.
Engineers
Verify with the two checks the coverage publishes: Get-AppxPackage with the AllUsers flag for every installed copy, and Get-AppxProvisionedPackage for the copy new profiles inherit; checking only your own account misses the per-user installs. Update through the Store or run the winget upgrade for the Paint store identifier, then rerun both checks and record the builds. If your vulnerability scanner clears machines at 11.2605.91.0, override it manually for this CVE and note why, because its source record still carries the superseded fixed build.
Everyone (non-IT)
On your own Windows 11 computer, this fix takes a minute and will not arrive by itself through the usual updates screen. Open the Microsoft Store, go to Library, and choose Get updates, then confirm Paint reaches version 11.2609.401.0 or later. If the Store has already updated your apps automatically, a quick version check is all you need. There is nothing to avoid opening in the meantime; the flaw needs no click from you, which is exactly why the update matters.