The Microsoft Store began serving Paint build 11.2609.401.0, the version Microsoft’s security data names as the fix for CVE-2026-83844, on 6 November, according to an engineering post from getrff.
getrff describes CVE-2026-83844 as an out-of-bounds read in Windows Paint that Microsoft rates as remote code execution, with a CVSS score of 8.1, no sign-in needed, no user interaction and high attack complexity. Microsoft rates it Important and, per getrff, it is not known to be exploited or publicly disclosed. Paint is a Store app, so the fix arrives through Store updates and not Windows Update, and Microsoft marks the CVE as requiring customer action.
Microsoft named 11.2605.91.0 as the fixed build when it published the CVE on 13 October. getrff says that build never appeared in the Store. By 4 November Microsoft’s machine-readable security data named 11.2609.401.0 instead, without a revision note. On 5 November the Store catalog in six markets offered only 11.2605.81.0. By 04:14 UTC on 6 November the same query returned 11.2609.401.0 for the US, UK and Germany, and getrff’s domain-joined lab machine picked it up through Store auto-update.
Why it matters
getrff warns that the public CVE record still lists Paint as affected only below 11.2605.91.0. A scanner that reads that record would count 11.2605.91.0 as fixed, and getrff says to go by 11.2609.401.0. Because Store apps install per user, and new profiles get a provisioned copy, a check has to cover every user and the provisioned package.
What to do
In our reading, patch dashboards that count Windows Update compliance will miss this one. Query installed Paint versions across all users and the provisioned image, compare against 11.2609.401.0, and run the Store update scan through your device management tool. Related coverage: Microsoft’s out-of-band .NET fix for CVE-2026-111497 and the Windows Shell flaw CVE-2026-96951.
Source: getrff, Windows Paint CVE-2026-83844: the fixed build is in the Microsoft Store now
