Microsoft Paint RCE Fix Ships via Store Only, Bypassing Windows Update

A remote code execution vulnerability in Microsoft Paint has been patched — but the fix will not arrive through Windows Update. According to The Hacker News, the correction for CVE-2026-83844 is distributed exclusively through the Microsoft Store, leaving organizations that manage patching through traditional Windows Update channels potentially exposed.

The Vulnerability

The flaw is classified as an out-of-bounds read that could allow an attacker to execute code over a network. Out-of-bounds read issues occur when software accesses memory beyond the boundaries of an allocated buffer, which can lead to information disclosure or, in certain conditions, arbitrary code execution. In the case of Paint, the network vector raises the stakes: an attacker may not need local access to a victim's machine to trigger the bug.

Microsoft has rated the vulnerability — though the severity rating was truncated in early reporting — and assigned it a dedicated CVE identifier, signaling that it met the company's threshold for a formal security advisory.

Why Windows Update Won't Help

Paint, like many inbox apps in modern Windows, is now delivered and updated through the Microsoft Store rather than as a core operating system component. That architectural shift has real consequences for patching. When a vulnerability is fixed in a Store app, the update flows through the Store's update pipeline — not through the monthly Patch Tuesday cycle or the Windows Update service that most enterprise patch-management tools monitor.

That means an organization can be fully current on Windows cumulative updates and still be running a vulnerable version of Paint. The fixed build is 11.2609.401.0, and The Hacker News reported that this was the newest Paint build available in all ten countries it checked on the day of publication — suggesting the rollout is broadly available, but only to those who actually check the Store.

The Enterprise Blind Spot

This is not an isolated quirk. Microsoft has spent years moving built-in applications — Calculator, Photos, Notepad, Terminal, and others — to Store-based delivery. The security upside is faster, more frequent patching independent of OS release cadence. The downside is a visibility gap: many endpoint management and vulnerability-scanning platforms inventory OS patches but do not track Store app versions with the same rigor.

Security teams should consider several practical steps:

  • Inventory Store app versions across the fleet, not just OS build numbers.
  • Enable and enforce automatic Store app updates through Group Policy or MDM where possible.
  • Add Store-delivered applications to vulnerability management scope, including Paint, Notepad, and other inbox apps.
  • Verify build numbers against vendor guidance rather than assuming Patch Tuesday coverage is complete.

Context: Paint as an Attack Surface

Paint may seem like an unlikely target, but image-parsing code has a long history as an attack vector. Maliciously crafted image files have been used repeatedly to exploit parsers and rendering engines. Any application that opens untrusted files — and Paint is among the most common — deserves scrutiny, particularly when the flaw can be triggered over a network.

What to Do Now

The remediation itself is simple: open the Microsoft Store, check for updates, and confirm Paint is at build 11.2609.401.0 or later. The harder problem is procedural. Organizations that rely solely on Windows Update for patch assurance now have a concrete example of why that assumption fails for Store-delivered software.

Given that the fix is already broadly available in the Store, the window for attackers to exploit unpatched systems is a function of how quickly defenders adapt their patching processes — not how quickly Microsoft shipped the code.

For the full original report, see The Hacker News.

Key Takeaways

  • CVE-2026-83844 is an out-of-bounds read in Microsoft Paint that can lead to remote code execution over a network.
  • The fix ships only through the Microsoft Store, not Windows Update.
  • The patched build is 11.2609.401.0.
  • Enterprises should extend vulnerability management to Store-delivered inbox apps.
  • Verify Paint versions directly; do not assume OS patching covers app-layer flaws.