CVE-2026-83844 is a vulnerability in Paint for Windows 11 that Microsoft rated 8.1 out of 10 and fixed on 13 October. Microsoft named the fixed version, but in early November users, administrators and journalists couldn’t find it in the Microsoft Store. How widespread the problem is remains unknown. As of publication, Microsoft had not reported any attacks through this hole, so there’s no reason to panic. But it’s worth checking your Paint — and while you’re at it, understanding why Windows Update is no longer responsible for all the programs that come with the system.
What is known about the vulnerability
Microsoft’s October batch of fixes was a record: more than 1,400 vulnerabilities in a single day. BleepingComputer counted 1,411, Qualys 1,414. Paint takes up one line on that list, and the general round-ups barely noticed it.
Microsoft’s description is short: an out-of-bounds read in Windows Paint allows an unauthorised attacker to execute code over a network. In plain terms, under certain conditions the program reads data outside the memory area allotted to it — this usually happens when parsing data that isn’t structured the way it expects. Most often, errors like this crash the program or leak fragments of memory that don’t belong to it. Microsoft says this error can lead to code execution but doesn’t disclose how exactly.
The 8.1 score breaks down like this: the attack comes over the network and requires neither an account nor any action from the user, and Microsoft considers the potential impact on confidentiality, integrity and availability to be high. But the attack complexity is marked as high. Microsoft’s explanation says the attacker needs a deep understanding of the system, and success is not guaranteed and depends on the environment, settings and protection mechanisms. The severity rating is “Important”, not “Critical”. The vulnerability wasn’t publicly disclosed before the fix came out, Microsoft names no known cases of attacks, and it rates the likelihood of exploitation as low. The labels from CISA, the US cybersecurity agency, tell the same story: at the time of assessment no exploitation had been observed, and in CISA’s view the attack cannot be automated.
Who found the vulnerability is unknown: Microsoft’s acknowledgements credit an anonymous researcher. Microsoft has published no detailed attack scenario and no proof-of-concept exploit, and they’re not in the materials I found either.
An odd detail: “a packet to a vulnerable service”
To the question “how could an attacker exploit the vulnerability”, Microsoft answers: an unauthorised attacker sends a specially crafted network packet to a vulnerable service, and no user interaction is required. For a graphics editor that sounds strange: Paint is an ordinary application, not a network service waiting for incoming connections.
It looks like a template. I checked the October release through Microsoft’s public API: the same phrase appears word for word in the descriptions of 57 vulnerabilities — in the DHCP server, DNS, the Network Policy Server and other components that really do accept packets from the network. So this phrase tells you nothing about how the attack works in Paint’s case specifically.
For comparison: in February 2026 Microsoft fixed vulnerability CVE-2026-20841 in Notepad and explained it in detail. The user opens a Markdown file, clicks a link inside it, and Notepad launches something it shouldn’t. There, Microsoft also explained separately why the vulnerability is called “remote” even though the attack itself runs on the victim’s computer. There are no such explanations for Paint.
Techzine and other outlets write that the attack goes through a specially prepared image, and Windows Latest put “a no-click vulnerability” in its headline. The first is a logical guess for a graphics editor, but it’s not in Microsoft’s text. The second restates the “no user interaction” flag in the score, not an established fact. Until the details are published, the attack method remains unclear, and it’s more honest to say so.
Who this affects
Microsoft names Paint from version 11.0.0.0 onwards as vulnerable. That’s the modern Paint from the Microsoft Store that is installed with Windows 11: its Store listing gives Windows 11 as the minimum OS. Classic Paint from Windows 10 doesn’t appear in the list of affected products. On my Windows 10 laptop that’s exactly the one installed, version 10.0.19041, and there’s no Store package at all. Absence from the list only means that Microsoft didn’t include it, not that old Paint was checked and found safe. Besides, support for Windows 10 ended back on 14 October 2025.
If you search Microsoft’s catalogue for the vulnerability, don’t be alarmed: searching for the word Paint turns up three more October entries such as “Use after free in Paint”. These are different vulnerabilities: they belong to the Chromium engine, where Paint is the name of the rendering subsystem, and Microsoft fixes them with an update to the Edge browser.
A patch that isn’t in the Store
The main problem in this story isn’t the vulnerability itself but delivering the fix. In Windows 11, Paint is updated not through Windows Update but through the Microsoft Store, like an ordinary app. Microsoft’s bulletin says exactly that: the fix is an app update in the Store, and action is required from the user.
Then the confusion over version numbers begins. Microsoft currently gives the fixed build as 11.2609.401.0. Meanwhile the CVE record on cve.org, updated on 31 October, still says versions before 11.2605.91.0 are vulnerable. According to Techzine, this number was originally in Microsoft’s bulletin as well. It’s also the number cited by a user who asked on 30 October on the official Microsoft Q&A forum where to get the update. He writes that only 11.2605.81.0 is available in the Store, and that version 11.2605.91.0 can’t be found either in the Store or in public release data. More than forty people with the same problem have chimed in under the question. The only reply came from a forum member, not a Microsoft employee, who suggested the number contains a typo. There’s no reply from Microsoft itself on the page.
The change of number to 11.2609.401.0 isn’t reflected in the bulletin’s revision history: there’s still a single entry there from 13 October — “information published”.
The availability problems didn’t go away after the number changed either. On 5 November Windows Latest and Techzine wrote about the problem. The Windows Latest author has Store auto-updates turned on, but Paint stayed on version 11.2603.251.0 and the Store offers no updates. According to Techzine, the Store kept serving 11.2605.81.0, and resetting the Store cache didn’t help. It looks as though the Paint version number encodes the year and month of the build: 2603 is March, 2605 May, 2609 September. If so, those who complained didn’t even have the September build that Microsoft calls fixed. But that’s my guess from the numbering; Microsoft doesn’t describe such a scheme.
Why this is happening is unknown. The update may be rolling out gradually and not in all countries at once: Techzine relays a user’s claim that the patch is only available in South Asia, and the Store link in Microsoft’s bulletin leads to the Singapore version of the Store. But that’s a coincidence, not confirmation. Another possibility is that the bulletin has the wrong number again. As of 6 November there’s no official explanation.
How to check your Paint version and what to do
First, open the Microsoft Store, go to “Library” and click “Get updates”. Then check the version number: the fact that the Store updated something doesn’t necessarily mean the right build was installed.
PowerShell shows the exact version number. It’s better to run it in the ordinary “Windows PowerShell” from the Start menu: in the newer PowerShell 7 the module for working with Store apps didn’t load for me, and the command failed with an error.
Get-AppxPackage -Name Microsoft.Paint | Select-Object Name, VersionMicrosoft names build 11.2609.401.0 as fixed: if you have that or newer, you’re fine. If the version is lower, the update hasn’t reached you yet. If the command ran without an error and printed nothing, Paint from the Store isn’t installed for your user account — though other users of the same computer may have it.
If the update doesn’t arrive, there’s no need to worry: there are no known attacks, and Microsoft rates the complexity as high. But you don’t have to sit and wait either. Until Microsoft explains how the attack works, you can temporarily stop using Paint and not open files from email, messaging apps or unfamiliar sites in it. If Paint is set as the default program for images, change that in “Settings”, in the “Apps” section, under “Default apps”. If you don’t need Paint at all, you can uninstall it in the same place, in the list of installed apps, and get it back from the Store once the fixed version becomes available. These are precautions, not Microsoft’s recommendation: how much they help against this particular vulnerability is unknown. Those responsible for a fleet of computers should pull a report on Paint versions through their device management system rather than trust the “all updates installed” status.
Why this isn’t only about Paint
For several years Microsoft has been moving Windows 11’s built-in programs to the Store: Paint, Notepad, Snipping Tool, Media Player, codecs. Updating them this way is faster, but there’s a flip side: Windows Update is no longer responsible for them. In the same October release another vulnerability was fixed through the Store — in the MPEG-2 video extension — and in February there was the Notepad vulnerability already mentioned.
Microsoft releases fixes on the second Tuesday of every month, and on those days it’s worth looking not only at Windows Update but also at the Microsoft Store “Library”. The Paint story shows that even there, “no updates” doesn’t always mean “everything is fixed”.
