In short, the Microsoft Store saying "up to date" doesn't tell you whether Paint is patched. Check the installed version yourself.
What the vulnerability is
The vulnerability databases mirror Microsoft's short official description: an out-of-bounds read in Windows Paint allows an unauthorized attacker to execute code over a network. The weakness is CWE-125. That means the code reads memory before the start or past the end of the buffer it is supposed to use.
The scoring explains why the story got attention:
| CVSS 3.1 metric | Value |
|---|---|
| Base score | 8.1 (High) |
| Attack vector | Network |
| Attack complexity | High |
| Privileges required | None |
| User interaction | None |
| Impact (C/I/A) | High / High / High |
Windows Report summed up the profile this way: it has a network attack vector, requires no privileges, and carries high attack complexity. Windows Latest added that Microsoft rates it as "Important," which is one step below Critical. The high complexity rating matters. "No privileges, no clicks" sounds frightening, but Microsoft is also saying a successful attack requires conditions that are hard to set up.
Image or packet? The reports disagree
How the bug is triggered depends on which report you read. Techzine and Windows Report describe a specially crafted image. Windows Report says the flaw could allow attackers to execute malicious code through specially crafted image files. SentinelOne's vulnerability database goes further. It attributes the root cause to improper bounds checking during image parsing inside the Windows Paint application.
Windows Latest quotes the MSRC wording differently: "An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network." The wording mentions a packet and a service, and says nothing about images.
Microsoft hasn't published a detailed exploitation chain, so readers shouldn't treat either description as settled. Rootaccessguy, a site tracking how the advisory has changed, reached the same conclusion. It notes that the available material does not identify the service, port, or a configuration test; it does not justify assuming every Paint installation is remotely reachable.
Section summary: This is a real, high-scored RCE in an inbox Windows 11 app. Microsoft calls it hard to exploit, and how an attack is delivered is still unclear from public information.
The version-number problem
The confusion follows a clear timeline.
- October 13: Neowin reports that Microsoft's Security Update Guide lists Paint version 11.2605.91.0 as the fixed release. The official CVE record follows that threshold. CVEtodo lists affected versions per the official CVE record as Microsoft Paint 11.0.0.0 up to, but not including, 11.2605.91.0.
- October 30: A user on Microsoft Q&A says they can't find 11.2605.91.0 through any Store channel and that the newest build available is 11.2605.81.0. The only reply is from another community member who guesses it's a typo and adds that he isn't Microsoft.
- Reddit reports: According to Neowin, one administrator even shared PowerShell output showing that Paint remained on version 11.2605.81.0 despite checking for updates through the Microsoft Store and running WSReset.
- November 2: Rootaccessguy reports that the official MSRC October CVRF/API document, dated November 2 at 08:00 UTC, now lists 11.2609.401.0 as the fixed Microsoft Paint build, replacing 11.2605.91.0 in the preceding retrieved document.
- November 5: Windows Latest's own PC had Store auto-updates enabled, showed no pending Paint update, and was still running 11.2603.251.0. The site also reports that IT admins on Reddit couldn't find the update even after pulling the app's MSIX package with a third-party tool.
The two official records still disagree. Microsoft's CNA record, last updated October 31, identifies versions 11.0.0.0 up to, but excluding, 11.2605.91.0 as affected. MSRC's current guidance points to 11.2609.401.0. A vulnerability scanner that reads the CVE record could mark a build compliant even though MSRC's current guidance says it isn't.
Why did the target change? Techzine says the earlier number looks like a typo. One user says the package is only available in South Asian regions. Windows Latest suggests Microsoft may have pulled the update or listed a version that doesn't exist. Microsoft hasn't confirmed any of these explanations, so treat them as speculation. Rootaccessguy did note one small detail: the Store app ID stayed the same, but the link's region changed from US to SG. That fits a regional-rollout theory but doesn't prove it.
Section summary: Use 11.2609.401.0 or later as the conservative target, since MSRC's current guidance names that build. Expect tools built on the CVE record to still use the older 11.2605.91.0 cutoff.
How to check your Paint version
The Store's update status is unreliable here, so ask Windows directly. Open PowerShell and run the command Windows Latest provides:
Get-AppxPackage -Name Microsoft.Paint | Select-Object Name, Version
What the result means:
- 11.2609.401.0 or higher: This build meets MSRC's current fixed-version target.
- Between 11.2605.91.0 and 11.2609.401.0: It meets the older threshold but not the current one. Treat it as unconfirmed.
- Below 11.2605.91.0 (such as 11.2605.81.0 or 11.2603.251.0): Vulnerable under either threshold.
Some practical notes based on general Windows administration experience:
- Without extra parameters,
Get-AppxPackagereports packages for the current user. From an elevated session, adding-AllUserscovers other profiles on the device. Neither version changes anything. They only read the installed version. - A Windows cumulative update doesn't fix this. Windows Latest warns that installing Windows 11's October 2026 update doesn't necessarily protect you, because Paint is maintained through the Microsoft Store and the app has to be updated separately.
- Windows Latest also suggests installing whatever Paint update the Store offers, even if its version number is below the documented fix. A newer build is better than an old one while Microsoft sorts out the documentation.
What to do while the patch is unavailable
Microsoft hasn't published an official workaround for this CVE. The options below come from Techzine and third-party vendors, and none has been tested against this specific bug:
- Restrict untrusted image attachments. Techzine suggests this as a temporary measure for organizations. It only helps if the image-based attack theory is correct.
- Uninstall Paint where nobody needs it. Techzine also suggests this. On kiosks, servers with desktop experience, and locked-down task workers, Paint is just attack surface.
- Change file associations. SentinelOne recommends that organizations restrict the file associations for Windows Paint so untrusted image formats open in a hardened viewer or sandboxed application.
- Monitor. SentinelOne's detection guidance flags malformed image files arriving by email, web download, or SMB shares shortly before Paint runs.
How worried should you be?
The available signals suggest moderate concern:
- CVEtodo reports that a CISA Coordinator recorded an SSVC decision for CVE-2026-83844 on 13 October 2026: no evidence of exploitation, not automatable, total technical impact.
- Rootaccessguy found the CVE absent from the reviewed CISA KEV catalog (1,766 entries, catalog dated October 30).
- CVEtodo reports that the EPSS score moved from 0.65% on 14 October 2026 to 0.73% on 4 November 2026. That's still a low estimated chance of exploitation in the next 30 days.
- Windows Latest says it hasn't seen reports of exploitation in the wild as of November 5.
These findings only describe the situation as of their dates. They don't mean unpatched machines are safe. Bugs rated "hard to exploit" sometimes get easier once someone compares the patched and unpatched builds. That's harder to do when hardly anyone has the patched build, which is an odd silver lining.
The bigger issue is how Microsoft services its inbox apps. Paint, Notepad, Snipping Tool, and the Photos app all update through the Store, outside Patch Tuesday's cumulative updates. Many organizations track compliance by KB number. This incident shows a gap in that approach: a fully patched Windows 11 PC can still run a vulnerable inbox app, while the Store reports nothing to install and two official records disagree on the target version.
Bottom line
- The flaw: CVE-2026-83844 is an out-of-bounds read in Paint that allows remote code execution. CVSS 8.1, high attack complexity, no privileges or user interaction required.
- The confusion: The fixed build moved from 11.2605.91.0 to 11.2609.401.0 in MSRC's data, while the CVE record still uses the older number. Microsoft hasn't explained the change.
- The action: Check the installed version with PowerShell, aim for 11.2609.401.0 or later, install any newer Paint build you can get, and remove Paint wherever nobody uses it.
Until Microsoft explains the discrepancy, treat the Store's "up to date" status as unverified.