Paint Flaw Tracked as CVE-2026-83844
Microsoft's Paint app patch through the Microsoft Store is not reaching some users, leaving them exposed to a flaw rated 8.1 out of 10 in severity.
Updated on Nov. 5, 2026 in Cybersecurity
Live Poll
Do you check your apps for security updates even when Windows says you're current?
Microsoft disclosed a Paint vulnerability, tracked as CVE-2026-83844, on October 13, 2026, rating it Important with a severity score of 8.1 out of 10. A patch was released through the Microsoft Store, but some users report the update is not appearing for them.
Why it matters
The flaw could allow remote code execution over a network without user clicks, and installing Windows 11's October 2026 update does not fix it. Users and IT administrators relying on automatic Store updates may remain exposed until the patch is delivered.
Microsoft describes the flaw as an out-of-bounds read that an unauthenticated attacker could trigger by sending a specially crafted network packet, with a severity score of 8.1 out of 10. The patched version is 11.2609.401.0 or newer, while the author's test machine ran 11.2603.251.0 with automatic Store updates enabled, and it is unclear why the update is not appearing for some users.
The players
Microsoft
Microsoft is the American technology company that develops Windows, the Paint application, and the Microsoft Store, and it issued the security advisory for this flaw.
The details
Microsoft released the Paint patch through the Microsoft Store on October 13, 2026, but IT administrators report the update is not visible in the Store for them. Installing the Windows 11 October 2026 update, which patched over 1,000 security issues, does not address the Paint flaw.
Timeline
October 13, 2026: Microsoft discloses CVE-2026-83844 and releases the Paint patch through the Microsoft Store.
October 2026: Windows 11 October update patches over 1,000 security issues, but not the Paint flaw.
November 5, 2026: Reporting on the unpatched Paint vulnerability is published.
Tech Race
Microsoft's CVE-based advisory process assigns identifiers and severity ratings to flaws like CVE-2026-83844, which Paint shares with Windows components rated under the same scheme. The gap between disclosure and delivery for this Store-distributed patch highlights how distribution channels for consumer apps can lag behind the security advisories that describe them.
Users who rely on automatic Store updates may still be running a vulnerable Paint version, so checking the installed version against 11.2609.401.0 or newer is a practical step. Enterprise antivirus tools may flag Paint as missing the security patch until the update is delivered.
The takeaway
Confirming your Paint version is at least 11.2609.401.0 is the most direct way to verify the fix, since the Store update may not appear automatically for every user. Checking this now protects against a flaw that can be triggered over a network without any user interaction.
Further reading
For more background on how software flaws are tracked and patched, explore our Cybersecurity coverage.
Source note: This article includes information reported by Windows Latest.
Live Poll
Do you check your apps for security updates even when Windows says you're current?
