---
title: Tip: Paint CVE-2026-83844 fix is Store-only — check every user copy and the provisioned package for 11.2609.401.0+ | ctxsec
url: https://ctxsec.com/items/tip-paint-cve-2026-83844-store-only-build-11-2609-401-0
description: "Microsoft rates CVE-2026-83844 (out-of-bounds read in Windows Paint \u2192 RCE over the network, CVSS 8.1 Important, high attack complexity) as Customer Action Required. The remediation is a Microsoft Store app update to build 11.2609.401.0, not a cumulative Windows Update. Paint is installed per user and can also sit as a provisioned package for new profiles \u2014 checking only the signed-in account misses older copies. MSRC lists Exploited: No."
status: "official (Microsoft MSRC CVE-2026-83844, fixedBuildNumber 11.2609.401.0 via Store); not known exploited; Customer Action Required"
published: 2026-11-06
---

> Microsoft rates CVE-2026-83844 (out-of-bounds read in Windows Paint → RCE over the network, CVSS 8.1 Important, high attack complexity) as Customer Action Required. The remediation is a Microsoft Store app update to build 11.2609.401.0, not a cumulative Windows Update. Paint is installed per user and can also sit as a provisioned package for new profiles — checking only the signed-in account misses older copies. MSRC lists Exploited: No.

[← Tips & Guides](/tips) · [markdown](/items/tip-paint-cve-2026-83844-store-only-build-11-2609-401-0.md)

official (Microsoft MSRC CVE-2026-83844, fixedBuildNumber 11.2609.401.0 via Store); not known exploited; Customer Action Required

2026-11-06

### Tip: Paint CVE-2026-83844 fix is Store-only — check every user copy and the provisioned package for 11.2609.401.0+

- As admin PowerShell: `Get-AppxPackage -AllUsers -Name Microsoft.Paint | Select Version` and `Get-AppxProvisionedPackage -Online | Where DisplayName -eq 'Microsoft.Paint' | Select Version`.
- Anything below **11.2609.401.0**: trigger Store app updates (or Intune Store scan) and re-check. Do not trust scanners that still treat ≥11.2605.91.0 as fixed — that older number is what the CVE text historically listed.
- No MSRC workaround; unused fleets can remove Paint for all users and the provisioned copy until confirmed current.

Sources: [Microsoft Security Update Guide: CVE-2026-83844](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83844) · [The Hacker News: Paint RCE fix is in the Store, not Windows Update (Nov 6)](https://thehackernews.com/2026/11/microsoft-paint-rce-fix-now-available.html) · [NCSC-NL alert (Nov 6)](https://www.ncsc.nl/alerts/kwetsbaarheid-in-microsoft-windows-paint-met-risico-op-misbruik)