Microsoft fixed CVE-2026-83844, a remote code execution flaw in the Windows 11 Paint app, in its October 13, 2026 security release. It is an out-of-bounds read (CWE-125), rated Important with a CVSS 3.1 score of 8.1. Microsoft’s description says an unauthorized attacker can execute code over a network, and its FAQ says no authentication or user interaction is required. Paint is not part of the Windows cumulative update. It is a Microsoft Store app, so installing the October Windows update does not fix it. The fix also got harder to find after release. Microsoft first named 11.2605.91.0 as the fixed build, but that build never appeared in the public Store catalog. In early November Microsoft changed the fixed build in its Security Update Guide to 11.2609.401.0. On November 6 it added a revision note saying it released that build “to comprehensively address” the vulnerability, and updated the CVE record to the same cutoff. Affected and fixed versions Product Affected Fixed Delivered through Microsoft Paint (Store package Microsoft.Paint) on Windows 11 11.0.0.0 to below 11.2609.401.0 11.2609.401.0 or later Microsoft Store, product ID 9PCFS5B6T72H Microsoft lists only the Paint app. Classic Paint on Windows 10 is not listed, and the Store package requires Windows 11 (build 22000 or later). Why the fixed build changed The original Security Update Guide entry and CVE record listed builds from 11.0.0.0 up to, but not including, 11.2605.91.0 as affected. The Security Update Guide and Microsoft’s October CVRF data now name 11.2609.401.0 as the fixed build. Microsoft’s revision 2.0, dated November 6, says the new build was released to comprehensively address the CVE and recommends installing it or confirming it updated automatically. Microsoft does not say the earlier fix was incomplete. The CVE record was updated on November 6 and now lists builds below 11.2609.401.0 as affected, so all of Microsoft’s sources agree. The public Store catalog for Paint, as we read it on November 6, lists 11.2605.71.0 and 11.2605.81.0, then 11.2609.401.0. There is no 11.2605.91.0. That explains why administrators who updated in October could not get past 11.2605.81.0. Some scanners may still carry the old 11.2605.91.0 cutoff from cached CVE data. Insider channel builds can fall between the two, so treat anything below 11.2609.401.0 as vulnerable whatever your scanner says. How the attack works Microsoft has published only a few lines about this flaw: Type: an out-of-bounds read, where Paint reads memory past the end of a buffer while processing attacker-controlled data. CVSS vector: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. That is network attack vector, high attack complexity, no privileges and no user interaction. Attack complexity: Microsoft says exploitation requires a deep understanding of the system and is not guaranteed. FAQ: an unauthenticated attacker sends a specially crafted packet to an affected service over the network. Paint is a desktop app that opens files. It does not normally run a network service, and Microsoft has not named a service, a port or a file format. The FAQ wording matches what Microsoft uses for network service flaws, and it does not fit how Paint usually works. In our assessment the realistic delivery path is crafted image data that reaches Paint, for example an image from a download, an email attachment or a network share. Until Microsoft explains, plan for its own wording too: code execution in the context of the user running Paint, with no click beyond what Paint already does on its own. Microsoft credits an anonymous researcher. No technical write-up or proof of concept has been published, and Microsoft rates exploitation less likely. Several GitHub repositories named after the CVE appeared on November 6; the ones we reviewed hold version-check scripts or nothing at all, including one labeled as a proof of concept. Who is exposed, in priority order Windows 11 PCs where the Store or its app updates are blocked. Paint stays on the vulnerable build indefinitely. This is common on locked-down corporate fleets and kiosks. PCs of users who handle images from outside the organization: marketing, design, recruitment, support and anyone who opens screenshots sent by customers. Shared and multi-user PCs. The Store updates Paint per user profile, so one profile can be fixed while another is not. Every other Windows 11 PC with Store updates working. Most will already be on 11.2609.401.0 or will get it within days. Check rather than assume. How to check your PCs On one PC, run this in an elevated PowerShell window. It only reads the installed version for each profile: Get-AppxPackage -AllUsers -Name Microsoft.Paint | Select-Object Name, Version, PackageUserInformation In the Paint app, open Settings and read the version under “About Paint”. Across the fleet, use Defender Vulnerability Management, Intune app inventory or your software inventory tool, and filter for Paint below 11.2609.401.0. Hunt 1 below does this in Defender. Do not rely on the Store saying “up to date”. Store status reflects what the Store offered that profile, not whether the build is fixed. Mitigation and remediation Update Paint to 11.2609.401.0 or later. In the Microsoft Store, open Downloads and select “Get updates”. To update from the command line, for example in a remediation script: winget upgrade --id 9PCFS5B6T72H --source msstore --accept-package-agreements --accept-source-agreements Unblock Store app updates where your policy blocks them, at least for Paint, or deploy Paint as a required “Microsoft Store app (new)” in Intune so Intune keeps it current. Confirm the version afterwards on each PC and each user profile. Restart Paint, or the PC if asked. Remove Paint where it is not needed and cannot be kept current, such as kiosks, servers with desktop experience and jump hosts. This is our recommendation, not a Microsoft workaround: Get-AppxPackage -AllUsers -Name Microsoft.Paint | Remove-AppxPackage -AllUsers Get-AppxProvisionedPackage -Online | Where-Object DisplayName -eq 'Microsoft.Paint' | Remove-AppxProvisionedPackage -Online Treat images from outside the organization as untrusted until the update is in place. Keep Mark of the Web on downloads and attachments, and keep attachment scanning on for image types. Microsoft publishes no workaround or mitigation for this flaw. Threat hunting No exploitation has been reported, so these hunts look for the behavior an exploited Paint would show: crashes, child processes, network activity and dropped files. Paint normally does none of these beyond its own Microsoft services. Microsoft Sentinel and Defender queries The KQL below is example code for Microsoft Sentinel and Microsoft Defender for Endpoint. Adapt table and field names to your environment and test each query before relying on it. Hunt 1: PCs with Paint below the fixed build Defender Vulnerability Management lists Store apps in its software inventory. Compare the version against 11.2609.401.0, and check that your scanner is not still using the old 11.2605.91.0 cutoff. // Example: Defender XDR, Paint installs below 11.2609.401.0 DeviceTvmSoftwareInventory | where SoftwareVendor has "microsoft" and SoftwareName has "paint" | where parse_version(SoftwareVersion) < parse_version("11.2609.401.0") | summarize Devices=dcount(DeviceId), Sample=make_set(DeviceName, 20) by SoftwareName, SoftwareVersion, OSPlatform | order by Devices desc If the inventory does not list Paint, read the version from the path Paint runs from: // Example: Defender XDR, Paint versions seen running in the last 30 days DeviceProcessEvents | where Timestamp > ago(30d) | where FolderPath has "Microsoft.Paint_" | extend PaintVersion = extract(@"Microsoft\.Paint_([\d\.]+)_", 1, FolderPath) | summarize LastRun=max(Timestamp), Users=make_set(AccountName, 10) by DeviceName, PaintVersion | where parse_version(PaintVersion) < parse_version("11.2609.401.0") | order by LastRun desc Hunt 2: Paint starting other programs An exploit that gets code running inside Paint will usually start a shell, a script host or a download tool. Paint itself should start almost nothing. // Example: Defender XDR, child processes of Paint DeviceProcessEvents | where Timestamp > ago(30d) | where InitiatingProcessFolderPath has "Microsoft.Paint_" or InitiatingProcessFileName =~ "mspaint.exe" | where FileName !in~ ("mspaint.exe", "WerFault.exe", "msedge.exe") | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, InitiatingProcessFolderPath | order by Timestamp desc Any hit on cmd.exe, powershell.exe, pwsh.exe, rundll32.exe, regsvr32.exe, mshta.exe, wscript.exe, cscript.exe, curl.exe or bitsadmin.exe needs investigating straight away. Hunt 3: Paint listening on the network or talking to unusual hosts Paint never needs to accept inbound connections. Its AI and sign-in features talk to Microsoft services, so outbound traffic to anything else is worth a look. // Example: Defender XDR, Paint network activity outside Microsoft services let MicrosoftDomains = dynamic(["microsoft.com", "microsoftonline.com", "live.com", "live.net", "bing.com", "msftauth.net", "msauth.net", "office.com", "office.net", "windows.net", "azureedge.net", "azurefd.net", "msedge.net", "akamaized.net", "windows.com", "mp.microsoft.com"]); // tune for your tenant DeviceNetworkEvents | where Timestamp > ago(30d) | where InitiatingProcessFolderPath has "Microsoft.Paint_" or InitiatingProcessFileName =~ "mspaint.exe" | where ActionType in ("ListeningConnectionCreated", "InboundConnectionAccepted") or (RemoteIPType == "Public" and not(RemoteUrl has_any (MicrosoftDomains))) | summarize Connections=count(), Ports=make_set(RemotePort), Urls=make_set(RemoteUrl, 10), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, ActionType, RemoteIP | order by FirstSeen desc Hunt 4: Paint crashing Failed exploit attempts against an out-of-bounds read usually crash the app. A run of Paint crashes on one PC, or crashes right after an image arrived from outside, is a lead. // Example: Defender XDR, Windows Error Reporting started for Paint DeviceProcessEvents | where Timestamp > ago(30d) | where FileName =~ "WerFault.exe" | where InitiatingProcessFileName =~ "mspaint.exe" or InitiatingProcessFolderPath has "Microsoft.Paint_" | summarize Crashes=count(), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, AccountName | order by Crashes desc If you collect the Windows Application log in Sentinel, event 1000 gives the faulting module and exception code. An access violation (0xc0000005) fits a memory read past a buffer. // Example: Sentinel Event table, Application Error events for Paint Event | where TimeGenerated > ago(30d) | where EventLog == "Application" and Source == "Application Error" and EventID == 1000 | where RenderedDescription has "mspaint.exe" | project TimeGenerated, Computer, RenderedDescription | order by TimeGenerated desc Hunt 5: images from outside the organization opened in Paint This shows which users open downloaded, emailed or network share images in Paint, which is where to look first if a crash or child process turns up. // Example: Defender XDR, Paint opening files from download, mail, temp or network paths DeviceProcessEvents | where Timestamp > ago(30d) | where FolderPath has "Microsoft.Paint_" or FileName =~ "mspaint.exe" | where ProcessCommandLine has_any (@"\Downloads\", @"\INetCache\", @"\Content.Outlook\", @"\AppData\Local\Temp\", @"\\") | project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName | order by Timestamp desc Hunt 6: Paint writing executables, scripts or persistence Paint saves images. It has no reason to write programs, scripts or shortcuts, or to touch autorun registry keys. // Example: Defender XDR, executable or script files and Run keys written by Paint let PaintFiles = DeviceFileEvents | where Timestamp > ago(30d) | where InitiatingProcessFolderPath has "Microsoft.Paint_" or InitiatingProcessFileName =~ "mspaint.exe" | where FileName matches regex @"(?i)\.(exe|dll|scr|ps1|bat|cmd|vbs|js|hta|lnk)$" | project Timestamp, DeviceName, Activity="file", Detail=strcat(FolderPath, " ", SHA256); let PaintRegistry = DeviceRegistryEvents | where Timestamp > ago(30d) | where InitiatingProcessFolderPath has "Microsoft.Paint_" or InitiatingProcessFileName =~ "mspaint.exe" | where RegistryKey has_any (@"\CurrentVersion\Run", @"\CurrentVersion\RunOnce", @"\Winlogon", @"\Services\") | project Timestamp, DeviceName, Activity="registry", Detail=strcat(RegistryKey, " ", RegistryValueName, "=", RegistryValueData); union PaintFiles, PaintRegistry | order by Timestamp desc Responding to a suspected compromise Isolate the PC in Defender and keep the image file that was open, the Paint crash dumps and the timeline from Hunts 2 to 6. Update Paint to 11.2609.401.0 or remove it before reconnecting the PC. Treat the user’s sessions as exposed. Code running in Paint runs as that user, so revoke their sign-in sessions and refresh tokens and reset the password. Look for the same image elsewhere. Search mail, file shares and other endpoints for the file’s hash and name. Rebuild the PC if Paint started a shell, wrote an executable or created persistence. Indicators of compromise None have been published. Microsoft has not released technical details, and no exploit or exploitation has been reported. The hunts above look for behavior rather than indicators for that reason. Timeline October 13, 2026: Microsoft publishes CVE-2026-83844 in its October security release, with 11.2605.91.0 as the fixed build. CISA’s assessment in the CVE record: exploitation none, not automatable, total technical impact. October 31, 2026: Microsoft updates the CVE record. The affected range still ends below 11.2605.91.0. Early November 2026: The Security Update Guide and October CVRF data change the fixed build to 11.2609.401.0, with no new revision entry. November 5, 2026: The Store catalog listing for Paint is updated. On November 6 it lists 11.2609.401.0 and no 11.2605.91.0. November 6, 2026: Microsoft adds revision 2.0, saying it released Paint 11.2609.401.0 to comprehensively address the CVE. The CVE record is updated to the same cutoff. The CVE is not in CISA KEV, and FIRST’s EPSS gives it 0.73%. Frequently Asked Questions Does the October Windows update fix this? No. Paint is a Store app and updates through the Microsoft Store, separately from the Windows cumulative update. Which version is safe? 11.2609.401.0 or later. Microsoft first said 11.2605.91.0, but that build was never published in the Store. Microsoft’s November 6 revision and the CVE record now both name 11.2609.401.0. Can an attacker really exploit Paint over the network with no user action? That is what Microsoft’s description and CVSS vector say, but Paint does not normally run a network service and Microsoft has not said which service is affected. The more likely path is crafted image data reaching Paint. Patch on Microsoft’s terms either way. Is it being exploited? No. Microsoft lists it as not exploited and not publicly disclosed, and it is not in CISA KEV. Is Windows 10 affected? Microsoft lists only the Paint app for Windows 11. Classic Paint on Windows 10 is not listed. Our Store says Paint is up to date, but the version is lower. What now? Check whether policy blocks Store app updates for that PC or profile, then run the winget upgrade command above or deploy Paint through Intune. Confirm the version afterwards. Can we just uninstall Paint? Yes, on PCs where nobody needs it. Windows 11 allows Paint to be removed, and the commands are above. How ThreatDefence is responding ThreatDefence has added CVE-2026-83844 and the 11.2609.401.0 fixed build to our vulnerability intelligence. Where we hold Microsoft Defender and Windows telemetry, our SOC is: identifying Windows 11 PCs with Paint below 11.2609.401.0 watching for Paint crashes, child processes, network connections and dropped files helping customers fix Store update policies that keep Paint on old builds If you want help checking your fleet or investigating a suspicious Paint crash, contact us. Read more about our managed detection and response and Microsoft Sentinel MDR. Sources Microsoft Security Response Center, CVE-2026-83844 Windows Paint Remote Code Execution Vulnerability (revision 2.0, November 6, 2026) Microsoft Security Response Center, October 2026 security updates CVRF data (checked November 7, 2026) CVE Program, CVE-2026-83844 record (updated November 6, 2026) Microsoft Store, Paint (product ID 9PCFS5B6T72H, catalog checked November 7, 2026) CISA, Known Exploited Vulnerabilities catalog (checked November 7, 2026) FIRST, EPSS score for CVE-2026-83844 (November 6, 2026) Microsoft Learn, Get-AppxPackage Microsoft Learn, Remove-AppxPackage Microsoft Learn, winget upgrade command Microsoft Learn, Add Microsoft Store apps to Intune Microsoft Learn, DeviceTvmSoftwareInventory table (Defender XDR advanced hunting)