Microsoft Paint RCE Vulnerability CVE-2026-83844 Fixed via Microsoft Store Update

A remote code execution vulnerability (CVE-2026-83844) in Microsoft Paint has been fixed via a Microsoft Store update, but the patch is not distributed through standard Windows Update. The updated version 11.2609.401.0 is available in the Store, addressing an out-of-bounds read flaw that could allow network-based code execution.

A fix for CVE-2026-83844, a remote code execution flaw in Windows Paint, is now in the Microsoft Store. Paint gets this fix only through a Store update, not through Windows updates.

The fixed build, 11.2609.401.0, was the newest Paint build in all ten countries The Hacker News checked today.

The flaw is an out-of-bounds read that could let an attacker run code over a network. Microsoft rates

Read original article