The Store has the fix. The same catalog query that returned 11.2605.81.0 on November 5 at 03:34 UTC returned 11.2609.401.0 for the US, UK and Germany at 04:14 UTC on November 6. My domain-joined lab VM had already picked it up through Store auto-update, for the signed-in user and the provisioned copy, before I ran anything.
So steps 2 and 4 below are now one step: run the Store update scan, or wait for auto-update, and check that every user’s copy and the provisioned one reach 11.2609.401.0. Removing Paint is no longer needed to stay safe.
One thing to watch if you check with a vulnerability scanner. The public CVE record still lists Paint as affected only below 11.2605.91.0, the build Microsoft named at publication on October 13, while Microsoft’s own security data says 11.2609.401.0. A scanner that reads the CVE record would call 11.2605.91.0 fixed. Go by 11.2609.401.0.
CVE-2026-83844 is an out-of-bounds read in Windows Paint that Microsoft rates as remote code execution: CVSS 8.1, over the network, no sign-in, no user interaction, high attack complexity. Microsoft published it on October 13 and rates it Important. It isn’t known to be exploited or publicly disclosed.
Paint is a Microsoft Store app, so the fix doesn’t come through Windows Update. It comes when the Store updates Paint, and Microsoft marks the CVE “Customer Action Required: Yes”. Windows Latest found their PC on Paint 11.2603.251.0 with Store auto-updates on and no update offered, and admins on couldn’t find one either.
I checked why: the fixed build Microsoft names isn’t in the Store.
The fixed build has changed once already:
11.2605.91.0 never showed up anywhere, and by November 4 Microsoft had replaced it with 11.2609.401.0 in its machine-readable October security data. Microsoft didn’t add a revision note for the change, so I can’t say exactly when it happened. 11.2609.401.0 is the build to go by.
On November 5 at 03:34 UTC I asked the Store’s own product catalog which Paint packages it has, for the US, UK, Germany, Australia, India and Singapore (Microsoft’s advisory links the Singapore listing). Every market listed the same newest package: 11.2605.81.0 . Nothing newer exists for the Store to install.
What we found in the lab
Both of our Windows 11 lab machines, an HP EliteOne and a domain-joined VM, had Paint 11.2605.81.0 for every user, and so did the provisioned copy that new profiles get. Both are up to date as far as the Store is concerned and both are below the fixed build.
On the VM I ran the Store update scan that Intune and other MDMs use ( UpdateScanMethod on MDM_EnterpriseModernAppManagement_AppManagement01 , as SYSTEM) and watched Paint for four minutes. It stayed on 11.2605.81.0, because the Store has nothing newer to give it.
Microsoft’s FAQ says an attacker could exploit it “by sending a specially crafted packet to an affected service over the network”. That’s an odd description for an image editor, and the advisory doesn’t say more. I don’t know what the real trigger is.
From an elevated PowerShell, every user’s copy and the provisioned one:
Don’t drop the -AllUsers . Without it you only see your own copy, and Store apps are installed per user. Anything below 11.2609.401.0 is vulnerable.
And what the Store is serving right now (change market=US to your country code):
If that prints 11.2609.401.0 or later, the fix is out and a Store update will install it.
Find every machine with Paint below 11.2609.401.0, per user and the provisioned copy.
Find every machine with Paint below 11.2609.401.0, per user and the provisioned copy.
Bring anything older than the Store’s newest (11.2605.81.0 today) up to it. Windows Latest’s 11.2603.251.0 is two releases behind even that. Your MDM’s “update Store apps” (the scan above) does it fleet-wide.
Bring anything older than the Store’s newest (11.2605.81.0 today) up to it. Windows Latest’s 11.2603.251.0 is two releases behind even that. Your MDM’s “update Store apps” (the scan above) does it fleet-wide.
Where nobody needs Paint, consider removing it until the fix ships, for every user and from the provisioned copy so new profiles don’t get it back: Get-AppxPackage - AllUsers - Name Microsoft.Paint | Remove-AppxPackage - AllUsers Get-AppxProvisionedPackage - Online | Where-Object DisplayName -eq 'Microsoft.Paint' | Remove-AppxProvisionedPackage - Online Users can put it back from the Store later. I didn’t test removal in the lab, so try it on one machine first.
Where nobody needs Paint, consider removing it until the fix ships, for every user and from the provisioned copy so new profiles don’t get it back:
Users can put it back from the Store later. I didn’t test removal in the lab, so try it on one machine first.
Check the Store again over the few days. When 11.2609.401.0 shows up, run the update scan everywhere.
Check the Store again over the few days. When 11.2609.401.0 shows up, run the update scan everywhere.
The RFF Script Library has a Paint check for CVE-2026-83844 that lists every installed Paint version with the users who have it, the provisioned copy, and the newest Paint the Store is serving for that machine’s region, so “not updated yet” and “nothing to update to” read differently. A second entry runs the Store update scan as SYSTEM, waits for Paint to change and reports whether it reached 11.2609.401.0. There’s also a Check that alerts on any machine below the fixed build and clears by itself once the Store delivers it. We ran the version check on both Windows 11 lab machines and the update and the Check on the VM. On November 4 they all reported vulnerable, with the Store’s newest at 11.2605.81.0. On November 6 the check and the update on the VM both reported Paint 11.2609.401.0, fixed, with the Store’s newest at 11.2609.401.0.
RFF is free for your first 100 endpoints: getrff.com .
Microsoft Security Update Guide, CVE-2026-83844 : CVSS, description, FAQ, Store delivery
MSRC October 2026 security data (CVRF) : fixed build 11.2609.401.0, “Customer Action Required”
Windows Latest : auto-update not delivering the fix, the 11.2603.251.0 machine
CVE record, CVE-2026-83844 : affected below 11.2605.91.0, published October 13, last updated October 31
Microsoft Q&A: Microsoft Paint 11.2605.91.0 : the earlier fixed build that couldn’t be found
Microsoft Store listing for Paint : the package the advisory links
use GitHub Discussions, so you'll need a GitHub account to post. Corrections are especially welcome.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
