Vulnerable Windows Paint can pass scans as patched

The fix for CVE-2026-83844, a remote code execution bug in Windows Paint, ships as build 11.2609.401.0 and reaches machines only through the Microsoft Store. Windows Update does not carry it. The CVE record Microsoft publishes for the same flaw lists Paint as affected only below 11.2605.91.0, and the NVD entry copies that range. Those two numbers disagree by several builds, and the gap is wide enough that a vulnerable copy of Paint can pass a vulnerability scan as fixed.

The flaw is an out-of-bounds read that an attacker can use to run code over a network. Microsoft rates it Important with a CVSS score of 8.1 and says a successful attack requires a deep understanding of the target system. The advisory describes exploitation as sending “a specially crafted packet to an affected service over the network” and does not name the service. No sign-in and no user interaction are required. When Microsoft published the advisory on October 13, the flaw was not known to be exploited or publicly disclosed, and it was not in CISA’s Known Exploited Vulnerabilities catalog when The Hacker News checked today.

Which build counts as fixed

Microsoft’s security advisory names 11.2609.401.0 as the fixed build. The CVE record, which Microsoft also publishes, still lists Paint as affected only below 11.2605.91.0, and NVD shows the same range. A scanner that reads the CVE record treats any build from 11.2605.91.0 upward as patched, including builds that sit below the advisory’s fixed version and still carry the bug. A copy at 11.2609.401.0 or later clears both numbers, so that is the version to standardize on.

The advisory itself gave 11.2605.91.0 as the fixed build as recently as last week, according to a question on Microsoft Q&A. The advisory’s revision history still shows only its October 13 entry, with no note recording the change. If you pulled the fixed version from the advisory before this week, you have the wrong number.

How fast it reaches a fleet isn’t clear

Because Paint patches arrive through the Store rather than Windows Update, the fixed build reaches machines on the Store’s rollout schedule. Brian Vitko of RFF, which makes device-management software, checked which build the Store offered in six countries earlier this week and found the newest in each was 11.2605.81.0, without the fix. The Hacker News checked ten countries today and found 11.2609.401.0 as the newest everywhere. Vitko’s test VM moved to the fixed build on its own through Store auto-update, but that is one machine, and how fast the rest of a fleet will follow is not yet clear.

Check every copy, not just yours

Paint installs per user account, and Windows can also keep a provisioned copy that it hands to each new user. A check of only the signed-in account misses older copies sitting under other users or in the provisioned image. Vitko’s write-up gives two commands to run in an administrator PowerShell window:

Get-AppxPackage -AllUsers -Name Microsoft.Paint | Select-Object Version, @{ n = 'Users'; e = { $_.PackageUserInformation.UserSecurityId.Username -join ', ' } }
Get-AppxProvisionedPackage -Online | Where-Object DisplayName -eq 'Microsoft.Paint' | Select-Object Version

The first lists every user’s copy with the accounts it belongs to; the second lists the provisioned copy. For any version below 11.2609.401.0, update Paint through the Store or let Store auto-update install the fixed build. In Intune and other device-management tools, the Store app update scan does this across many machines at once. Run both commands again afterward and confirm every copy reads 11.2609.401.0 or later.

The advisory lists no workaround or mitigation. Before the fix reached the Store, Vitko suggested removing Paint anywhere nobody needs it, for every user and from the provisioned copy, though he notes he did not test that step.