Windows 11 Paint Flaw CVE-2026-83844 Allows Remote Code Execution
A flaw in Paint for Windows 11 lets attackers run code remotely. Microsoft has released a fix, but the Microsoft Store is not offering it on some PCs.
SUMO· the number puzzle
Dialo· learn languages by speaking
ediviewer· read EDI files like documents
giftdetect· the right gift in minutesA vulnerability in the Paint app for Windows 11 can let attackers execute arbitrary code on a PC remotely, without any action from the user. Microsoft has prepared a fix, but it is not showing up in the Microsoft Store, even on devices with automatic app updates switched on.
The bug is tracked as CVE-2026-83844 and carries a severity score of 8.1 out of 10. It stems from an out-of-bounds read, a memory-handling error. According to Microsoft's description, an attacker only needs to send a specially crafted network packet to the vulnerable service to trigger code execution on the target machine. No prior authentication is required.
Rated Important, not Critical
Microsoft classes the issue as Important, one step below its top Critical rating. The company also says the flaw is hard to exploit and that no attacks using it have been reported so far.
The patch is not arriving
The fix was released on October 13 through the Microsoft Store. Per the documentation, Paint version 11.2609.401.0 and newer is protected. However, Windows Latest found that the Store did not offer the new build even with automatic updates enabled. The Paint settings on its test system showed version 11.2603.251.0.
Other users reported the same problem, and the update could not be obtained even with third-party tools for downloading MSIX packages. The cause is unknown.
A regular Windows 11 update does not solve this either, because Paint is updated separately through the Microsoft Store.
How to check your version
You can see the installed version in Windows PowerShell with the command Get-AppxPackage -Name Microsoft.Paint | Select-Object Name, Version. If the number is lower than 11.2609.401.0, Microsoft's documentation considers the app vulnerable.
Apps worth a look
SUMO: the number puzzleTap the right tiles, add them up, hit the target. Easy to learn, hard to master. Free, for all ages.
Dialo: learn languages by speakingTalk to an AI conversation partner; every sentence comes back corrected and explained in your language. 9 languages, A1 to C2.
ediviewer: read EDI files like documentsOpen EDIFACT and X12 messages, see every segment explained, convert to JSON/XML, export PDF and Excel. Runs locally, no upload.
giftdetect: the right gift in minutesPick who it is for, the occasion and their personality. The search engine reads product descriptions from local shops and ranks what fits. Free, no sign-up.
More from this day
See all →
Citus Demonstrates GPS-Free Firefighter Tracking, Eyes Military Use
Google Cloud expands CodeMender and AI agent security tools
Operation Ghostbusters: 830,840 Suspected Ghost Students Found
