Windows Paint Security Flaw CVE-2026-83844: Update Through the Microsoft Store, Not Windows Update

AI-generated illustration of a laptop showing a colourful painting in the Paint app, with a glowing shield and update arrow above the screen.

Microsoft has fixed a remote-code-execution flaw in Windows Paint, but the fix will not arrive the way most Windows updates do. The flaw, tracked as CVE-2026-83844, is an out-of-bounds read in the Windows 11 Paint app, and Microsoft rates it Important. The fixed build is 11.2609.401.0, and the only way to get it is to update Paint itself through the Microsoft Store. If you only keep Windows itself up to date, your Paint app may still be vulnerable, because the monthly Windows cumulative update never touches it. The good news is that the update takes about two minutes, the risk of an attack right now is low, and checking your version is simple. This guide explains what the flaw is, why Windows Update cannot fix it, which version number is actually safe, and exactly how to update.

Before the detail, keep the risk in proportion. Microsoft says the flaw has not been exploited, no public exploit code is known, and it does not appear in CISA's Known Exploited Vulnerabilities catalogue. On 7 November 2026, Microsoft also corrected its own description of the attack, changing it from a network attack to a local one that needs a user to open a crafted file, and lowered the severity score from 8.1 to 7.0. That does not make the update optional. It makes it a routine, low-drama fix that is worth doing now rather than later, because code run through this flaw would execute with the same rights as the person using Paint. Nothing in this article is a reason to stop using Paint. It is a reason to spend two minutes updating it.

As an Amazon Associate, we earn from qualifying purchases.

AMAZON'S CHOICEASUS Prime GeForce RTX 5060 8GB GDDR7 OC EditionVRAM: 8GB GDDR7, Amazon's Choice, 50+ bought in past monthView deal at Amazon >8-COREAMD Ryzen 7 9800X3D8 cores / 16 threads, up to 5.2 GHz, AM5, 96MB L3View deal at Amazon >850WCORSAIR RM850e (2025) Fully Modular ATX Power Supply850W, fully modular, ATX 3.1, PCIe 5.1, native 12V-2x6, Cybenetics GoldView deal at Amazon >

Prices and savings can change. Check the retailer for the current price.

What the flaw actually is

CVE-2026-83844 is an out-of-bounds read, classified as weakness CWE-125, in the Windows 11 Paint app that is delivered through the Microsoft Store. In plain terms, an out-of-bounds read means the app reads memory outside the buffer it was supposed to use, and in this case that mistake can be turned into running an attacker's code. Microsoft disclosed the flaw on 13 October 2026 as part of its October Patch Tuesday security release, and it rates the flaw Important. Microsoft's original description said an unauthenticated attacker could exploit it by sending a specially crafted packet to an affected service over the network, with no user interaction and no privileges required, but with high attack complexity. Microsoft said at the time that a successful attack "requires a deep understanding of the target system", and that the flaw was neither publicly disclosed nor exploited when it was published.

That description has since changed, and the change matters, so it gets its own section below. What has not changed is the core of the problem: Paint is one of the most ordinary apps on a Windows PC, it opens image files all day, and a flaw in it deserves the same two-minute fix as a flaw in a browser or an office app. Microsoft lists no workaround or mitigation for CVE-2026-83844. Updating Paint is the only defence it gives, which is another reason not to leave this one for later.

Why Windows Update will not fix it

This is the part that catches people out, including IT teams. Paint on Windows 11 is a Microsoft Store app, not part of the operating system image. The monthly cumulative update that patches Windows itself never touches it. Store apps update on a separate track, through the Microsoft Store, one user profile at a time. That means a PC can be completely green on Windows Update compliance and still be running a vulnerable copy of Paint on every desktop in the building. Security researchers writing about this flaw have made exactly that point: the October cumulative update does not fix it, and there is no separate KB article to install for it either.

The same split applies to other Store apps, such as Notepad and Photos, so the lesson is wider than Paint. Windows Update keeps the operating system patched. The Microsoft Store keeps the apps patched. If you never open the Store, your apps quietly fall behind, and no Windows Update badge will warn you about it. For managed PCs, the fix travels through the same Store channel, either as a Microsoft Store app assignment in Intune or through winget against the Microsoft Store source, and it still installs separately for each user profile. Checking one profile and assuming the rest are fine is not enough on a shared machine.

Which build is actually fixed: the version-number confusion

The second trap in this story is that Microsoft's own records have given two different answers about which Paint build contains the fix, and the wrong one is still floating around in some records. Microsoft first named build 11.2605.91.0 as the fixed build in October 2026. That build never appeared in the public Store catalogue. Researchers checking the Store in the US, UK, Germany, Australia, India and Singapore in early November found the newest available build was still 11.2605.81.0, which does not contain the fix.

In early November, Microsoft's Security Update Guide quietly switched the fixed build to 11.2609.401.0, with no revision note explaining the change at the time. The November 6 revision of the advisory confirmed that Paint 11.2609.401.0 was released to fix the flaw, and the fixed build finally landed in the Store on 5 to 6 November. The Hacker News checked the Store in ten countries on 6 November and found 11.2609.401.0 was the newest Paint build in all of them. Microsoft's own CVE record was also updated on 6 November, and now lists Paint versions from 11.0.0.0 up to, but excluding, 11.2609.401.0 as affected.

The practical rule is simple, and it is the one to remember: treat any Paint build below 11.2609.401.0 as vulnerable, whatever any other record says. Only 11.2609.401.0 or later passes under both of Microsoft's numbers, so that is the number to check against. If a scanner tells you a machine is fixed because it has 11.2605.91.0 or later, do not trust it, because that build never shipped through the Store and the older threshold is the wrong one.

What changed on 7 November: the attack is local, not over the network

On 7 November 2026, Microsoft published revision 2.1 of the advisory, and it corrects the attack path. The flaw is no longer described as code execution over a network. It is now described as code execution locally. The CVSS 3.1 base score falls from 8.1 to 7.0, the attack vector changes from network to local, and user interaction changes from none to required. Microsoft's revised FAQ explains that execution occurs locally and gives the example of a victim downloading and opening a crafted file. High attack complexity remains, the severity rating stays Important, and the title of the advisory is unchanged. Microsoft labelled the FAQ and score revision informational: it changes how the flaw should be triaged, while the fixed build and the affected version range stay exactly as confirmed on 6 November. Microsoft's CVE record was updated again on 7 November and now agrees with the revised description and score.

For a home user, the change is genuinely reassuring, and it should be stated plainly. Nobody can attack your PC through Paint simply because the app is installed. There is no internet-exposed Paint service to probe. An attacker would need you to download and open a malicious file in Paint, which is a much higher bar than the original network description suggested. But it is not a reason to skip the update. Crafted files arrive by email, download and shared drive every day, and Paint is a natural app to open an image with. The fix is still the same two-minute Store update, and the fixed build is still 11.2609.401.0.

How to check your Paint version

Checking takes less than a minute, and it is worth doing before you assume anything. Open Paint, click the Settings gear icon, then choose About, and the version number is shown there. If it reads 11.2609.401.0 or higher, you are done, and there is nothing else to do. If it reads anything lower, update it using the steps in the next section.

If you prefer the command line, open PowerShell and run Get-AppxPackage -Name Microsoft.Paint | Select-Object Name, Version, which prints the installed package version for your profile. Remember that this checks only your own user profile. On a shared family PC, each person who signs in has their own copy of the Store app, so the version should be checked on every profile that uses the machine.

One more scope note: classic Paint on Windows 10 is not listed as affected. The flaw concerns the Windows 11 Store app. If you are still on Windows 10 with the classic version of Paint, this particular advisory does not apply to you, although keeping Windows 10 itself patched remains important for other reasons.

How to update Paint in two minutes

The update itself is straightforward, once you know where to look. Open the Microsoft Store app, go to Library, and select Get updates. If Paint has a pending update, install it, or click Update all and let the Store handle everything at once. Then reopen Paint, go to Settings and About again, and confirm the version now reads 11.2609.401.0 or later. Restart Paint after the update, and reboot if the Store asks you to.

If you would rather use the terminal, open a command prompt or PowerShell and run winget upgrade --id 9PCFS5B6T72H --source msstore, which upgrades Paint from the Microsoft Store source. The product ID 9PCFS5B6T72H is Paint's Store listing, and the msstore source is what makes winget fetch the Store build rather than a classic installer.

Do not assume the Store's automatic updates have already handled it. Windows Latest reported on 5 November that some users with automatic updates switched on still had no Paint update available in the Store, and some IT administrators reported the same. The fixed build was only just landing in the catalogue that week, so the safe move is to check the version number yourself rather than trusting the auto-update setting. And do not download Paint from any third-party site: only the Microsoft Store carries the signed fixed build, and a random installer from the web is a far bigger risk than the flaw itself.

What if the update does not show up?

If you open the Store and Library shows no Paint update, do not panic, and do not go looking for the fix anywhere else. First, click Get updates again, because the Store sometimes needs a manual refresh before it lists a new app version. Then wait a little and check again later the same day, since Store rollouts can lag by region and by account even after the build is live. The Hacker News found the fixed build in all ten countries it checked on 6 November, so it is broadly available, but a single machine can still be a few hours behind.

If it still does not appear, check that you are signed in to the Store and that Store updates are not blocked on your machine. On a work or school PC, Store updates may be restricted by policy, in which case the fix has to come through your IT team and its own app deployment, so ask them rather than trying to work around the restriction. While you wait, the sensible precaution is the same one the revised advisory implies: be careful with image files from people or places you do not trust, and do not open unexpected attachments in Paint until the update is installed.

Should you worry? A calm risk check

It helps to put the risk in plain numbers. Microsoft says the flaw has not been exploited and was not publicly disclosed when it was published, and it rates exploitation as less likely. It is not in CISA's Known Exploited Vulnerabilities catalogue, which listed 1,769 entries in the version dated 6 November. The EPSS score, which estimates the chance of exploitation in the next 30 days, was about 0.73 percent in early November, which is low. The attack is complex, and since the 7 November correction it also needs a user to open a crafted file. No public exploit code is known to exist, and no vendor-directed compromise assessment or credential rotation has been recommended for this flaw.

On the other side of the scale, the impact if an attack did succeed would be serious, because any code an attacker runs gets the same rights as the person using Paint, and the CVSS impact ratings for confidentiality, integrity and availability are all high. Paint is also an app people open without thinking, often straight from a download or an email attachment. And the version confusion means some machines are wrongly reported as fixed by scanners that still use the old 11.2605.91.0 threshold, so the vulnerable population is probably larger than the dashboards suggest.

The balanced verdict is this: the risk today is low, the fix takes two minutes, and there is no reason to leave it undone. Update Paint, confirm the version, and move on. This is not a reason to stop using Paint, to avoid opening images, or to pay for a third-party tool that promises to fix it for you.

Quick checklist

Open Paint, go to Settings, then About, and note your version number.
If the version is below 11.2609.401.0, open the Microsoft Store, go to Library, and select Get updates.
Install the Paint update, or run winget upgrade --id 9PCFS5B6T72H --source msstore from a terminal.
Reopen Paint and confirm the version now reads 11.2609.401.0 or later.
Repeat the check on every user profile on a shared PC, because Store apps update per profile.
Until the update is installed, be careful with image files from senders or sources you do not trust.
Do not download Paint from third-party sites, and do not trust a scanner that calls a machine fixed at 11.2605.91.0.

Bottom line

Windows Paint has a real security flaw, CVE-2026-83844, and the fix is real too, but it will not reach you through Windows Update. Only the Microsoft Store delivers it, as Paint build 11.2609.401.0, and the update takes about two minutes. Microsoft's 7 November correction makes the picture calmer than it first looked: the attack is local, it needs you to open a crafted file, and nothing has been exploited. But the fix is still the same, the version to check against is still 11.2609.401.0, and the only defence Microsoft lists is the update itself. Open the Store, check your version, and get it done today, before the next crafted file finds its way to your inbox.