74 openlast updated

HomeOctober 2026 patch cycleCVE-2026-83844 Microsoft Paint RCE: Store-only fix

Known issueEnterpriseEnd-user appsfrom 2026-10

CVE-2026-83844 Microsoft Paint RCE: Store-only fix

Part of October 2026 patch cycle

Vendor
Microsoft
Products
Microsoft Paint and Windows 11
Published
Status
Open

Call: Known issue. CVE-2026-83844 is an Important (CVSS 8.1) remote code execution bug in Microsoft Paint: an attacker can send a crafted packet to an affected service over the network with no sign-in and no user click. Microsoft published it on Oct 13. The fix does not ride Windows Update. It only lands as a Microsoft Store app update. As of Nov 6, The Hacker News found fixed build 11.2609.401.0 in the Store across ten countries. It is not in CISA KEV, and Microsoft said it was not known to be exploited when the advisory went out.

What breaks: Nothing breaks when you update. The operational trap is that a fully patched Windows host can still be running an old per-user Paint package, and a provisioned copy can seed new profiles with the vulnerable build. The CVE record still lists Paint as affected below 11.2605.91.0, while the advisory names 11.2609.401.0 as the fixed build. Aim for 11.2609.401.0 or later so both numbers are happy.

Who’s hit: Windows PCs with Microsoft Paint from the Store (the default on modern Windows 11). Check every user profile and the provisioned package, not just the signed-in account.

What to do:

  • Update Paint from the Microsoft Store, or let Store auto-update / your MDM Store-app scan push it.
  • As admin PowerShell, verify every copy:
Get-AppxPackage -AllUsers -Name Microsoft.Paint | Select-Object Version, @{ n = 'Users'; e = { $_.PackageUserInformation.UserSecurityId.Username -join ', ' } }
Get-AppxProvisionedPackage -Online | Where-Object DisplayName -eq 'Microsoft.Paint' | Select-Object Version
  • If a copy is below 11.2609.401.0, update again and re-check. Microsoft lists no workaround; removing Paint for every user and from the provisioned package is the blunt option if you don’t need it.

Sources: The Hacker News, PCWorld, MSRC CVE-2026-83844, RFF write-up.

Sources

More from October 2026 patch cycle