Microsoft Paint RCE Fix Available via Microsoft Store, Not Windows Update

A remote code execution vulnerability in Windows Paint, identified as CVE-2026-83844, has been patched via a Microsoft Store update, but the fix is not being delivered through Windows Update, according to reporting from The Hacker News. The vulnerability is an out-of-bounds read that could allow an attacker to execute code over a network.

Microsoft has released the fixed build, version 11.2609.401.0, through the Microsoft Store. The article notes that this was the newest Paint build available in all ten countries checked. Despite the availability of the patch, Paint updates are distributed through the Microsoft Store rather than the standard Windows Update channel. This means users who rely on automatic Windows Update to keep their systems current may remain unpatched against CVE-2026-83844.

The source indicates that organizations with automated Windows Update policies may be exposed if Windows Paint is used on affected systems, as the patch will not reach those endpoints via the usual update mechanism. Microsoft has not publicly commented on whether a Windows Update delivery channel for the fix is planned.

Security researchers and analysts recommend that administrators monitor Microsoft Store updates for Paint and consider manual deployment methods to ensure coverage across endpoints, particularly in environments where Windows Paint is used for basic image editing tasks.