Microsoft's built-in Paint app on Windows 11 carries a remote code execution flaw that is fixed on paper and still present on a lot of machines. The patch ships through the Microsoft Store, and administrators are reporting that the Store is not offering it.

What happened

The bug is tracked as CVE-2026-83844, an out-of-bounds read in Windows Paint that Microsoft rates CVSS 8.1 and classifies as Important. A specially crafted image is enough to trigger it. Microsoft's own vector scores the attack as network-reachable, with no privileges required and no user interaction.

The fix was published on 13 October 2026 and lands in Paint build 11.2609.401.0. Microsoft's Security Update Guide initially named 11.2605.91.0 as the patched version, a build users could not find in the Store at all. The guidance was later corrected to 11.2609.401.0, and the Store is still rolling the newer build out unevenly.

Who is affected

Any Windows 11 device whose Paint app is still on an older build. There is no server component and no setting to switch off first: either the app is updated or it is not.

• Windows 11 workstations and laptops where Store app updates are blocked, deferred or handled by policy.
• Machines built from an image that predates October 2026 and never refreshed the bundled Store apps.
• Devices where the user insists Paint is up to date because the Store never offered the new build.

What to do now

Check the installed Paint build on the endpoint, not the Store status. Run Get-AppxPackage Microsoft.Paint in PowerShell and compare the version against 11.2609.401.0. If it is lower, force the app update or push it from your management tool.

• Run Get-AppxPackage Microsoft.Paint on a sample of endpoints to see what is actually installed.
• Clear the Store cache or trigger the app update from Intune, your RMM or the Store, then re-check the version.
• Where a device cannot be updated, remove Paint for staff who never use it, and filter untrusted image attachments at the mail gateway in the meantime.

What this means for South African businesses

Most South African SMEs run Windows 11 across a mix of bought, leased and re-imaged machines, and Store-delivered app updates are exactly the ones that quietly stop flowing once someone pins a version or disables the Store for control. The flaw needs a crafted image and high attack complexity, so this is not a drop-everything morning - but a fleet where nobody can say which Paint build is installed has no answer when such an image does arrive.

Microsoft documents the flaw and the fixed build in its Security Update Guide; the patch-delivery confusion was reported by Techzine.