CVE-2026-83844: Paint fix needs a Store update

Windows Update will not deliver the Paint fix for CVE-2026-83844. The update comes through the Microsoft Store, and Microsoft's advisory names 11.2609.401.0 as the fixed version, according to The Hacker News report. Use Get-AppxPackage to check all users and Get-AppxProvisionedPackage to check the provisioned copy. If either check returns a version below that advisory threshold, update through the Store. Microsoft lists no workaround.

On a managed Windows fleet, finishing a Windows Update cycle does not prove that Paint is patched. Paint is installed separately for each user. Windows can also retain a provisioned copy to install for new accounts, so the version you see while signed in is not the whole inventory. Checking only that user's installation can leave older copies on the same PC unaccounted for.

Run Paint's all-user and provisioned-version checks

Open PowerShell as administrator and run this command. It lists the Paint versions installed across existing user accounts and identifies the users associated with those installations.

$paintForUsers = Get-AppxPackage -Name Microsoft.Paint -AllUsers
$paintForUsers | Select-Object Version, @{
    n = 'Users'
    e = { $_.PackageUserInformation.UserSecurityId.Username -join ', ' }
}

Then run the separate provisioned-package check below. This finds the Paint copy that Windows can install for new users, rather than the copies already associated with existing accounts.

$provisionedApps = Get-AppxProvisionedPackage -Online
$provisionedApps |
    Where-Object DisplayName -eq 'Microsoft.Paint' |
    Select-Object Version

Compare every version returned by these commands with the advisory's 11.2609.401.0 threshold for CVE-2026-83844. An updated copy for the current user tells you nothing about whether another user's installation or the provisioned package has also been updated.

I'd keep both sets of results together when reviewing a device. Paint opening successfully is not the evidence needed here, and neither is a completed update task. What matters is which versions remain across the user installations and the provisioned copy that these checks expose.

Why CVE-2026-83844 version records disagree

The advisory and the vulnerability records currently disagree. Microsoft's security advisory for CVE-2026-83844 names 11.2609.401.0 as fixed, as reported by The Hacker News. NVD's November 7 record, meanwhile, is still undergoing analysis. It does not publish a fixed version, so it cannot supply the same version threshold.

The Hacker News describes another mismatch, this time between the advisory and Microsoft's company-published CVE record. According to its reporting, a scanner using that CVE record could accept a Paint build that falls short of the advisory's newer fixed-build threshold. That makes the installed version worth inspecting directly, even when a scanner has already returned a pass or fail.

Use the advisory's 11.2609.401.0 threshold for verification and record separately in the patch ticket that NVD has not yet published a fixed version. Attribute the threshold to Microsoft's advisory as reported by The Hacker News. That keeps the check tied to the vendor advisory. It does not require pretending that the conflicting records have been reconciled, because they have not. A later reviewer should be able to distinguish disagreement between the published records from disagreement about which version was actually installed on the device.

Suppose a management report marks Paint compliant, but the all-user check returns a version below the advisory threshold. Reconcile that report against the installation before closing the finding; the compliant label does not resolve the version mismatch. The reverse caution matters too: NVD's missing fixed-version information is not proof that the Store update does not exist.

Store availability is not a fleet deployment result

The Hacker News found that 11.2609.401.0 was the newest Paint build in all ten countries it checked. That supports the report's central change: the advisory-named fix for CVE-2026-83844 is available through the Store now. It is no longer just a fixed version identified in an advisory without that reported Store availability.

Brian Vitko's test virtual machine also reached that build through Store auto-update. Automatic delivery worked on that machine. It does not follow that every other PC has received the update, or that there is a known arrival time for each one. The report explicitly leaves that timing unclear.

For administrators, the distinction is between an update being available and an update being installed. The Store offering the build answers whether it can be obtained. The PowerShell results answer what is present on a particular device. Neither the ten-country availability check nor a successful auto-update on somebody else's machine substitutes for checking your own installations.

Trigger a Store app update scan through Intune or another device-management tool to use the delivery route the report identifies. That route is Store updating, including the Store app update scan available through Intune and other device-management tools. It is the reported path for getting the fixed Paint build onto managed PCs.

Apply the Paint Store update and verify both copies

Update through the Store, then check the installed versions again. A completed Windows Update deployment cannot stand in for this Paint update for CVE-2026-83844, even if the operating-system update work is otherwise finished.

1. Update Paint through the Microsoft Store, or let Store auto-update install the build. Across a fleet, use the Store app update scan through Intune or whichever device-management tool is responsible for those updates. The report supplies no deployment command.

2. Run both PowerShell checks above again as administrator. Compare every returned user installation and the provisioned copy against 11.2609.401.0 or later, using the advisory threshold reported by The Hacker News. Investigate any older copy that remains. One updated account is not enough to mark the whole PC complete while another returned copy is still below the threshold.

My preference is to trigger the managed Store update scan rather than wait without checking. The report gives no reliable arrival time for other PCs, so waiting does not answer the version question. Store auto-update is still a documented route; it needs the same verification afterward as a managed scan does.

On a shared workstation, give the existing-user check and the new-user check separate completion criteria. The first covers accounts already represented on the machine. The second covers the provisioned copy that Windows can install for a new account. Keeping those checks distinct follows the Paint installation model described in the report, rather than treating the signed-in user's copy as the entire installation.

What does Paint's network flaw require?

CVE-2026-83844 is an out-of-bounds read that could allow remote code execution. NVD records Microsoft's CVSS 3.1 score as 8.1, rated High, while Microsoft's advisory labels the issue Important. Those are the published score and severity labels. Neither label is evidence that an attack has succeeded.

The advisory, as described by The Hacker News, says an attacker could send a specially crafted packet to an affected service over the network. The attack would require no sign-in and no user assistance. Microsoft also says that carrying out a successful attack requires a deep understanding of the target system.

The attack requires no authentication or user interaction, but it still requires a deep understanding of the target system; that complexity does not mean it necessarily depends on persuading a user to open a malicious image.

When Microsoft published CVE-2026-83844 on October 13, it said the flaw was not known to be exploited or publicly disclosed. In a separate check on November 7, CISA did not list it in its Known Exploited Vulnerabilities catalog. The October statement describes what was known at that time. Absence from CISA's catalog is not a claim that exploitation is impossible.

Paint's unnamed service leaves no targeted mitigation

The advisory for CVE-2026-83844 does not name the affected network service. That omission limits how precisely an administrator can assess the attack path using this reporting. There is no basis here for naming a particular port, protocol or service to disable, because the affected service has not been identified.

Microsoft lists no workaround or mitigation. Before the fix became available through the Store, Vitko suggested removing Paint where it was unnecessary. His suggestion included every user's copy as well as the provisioned copy. He did not test that removal step.

I would not turn an untested suggestion into a confident removal recipe, much less present it as equivalent to installing the advisory-named fix. The reporting gives us inventory commands, not a tested removal procedure. Making up a command would be particularly unhelpful here: the difference between user installations and the provisioned copy is central to the very check being performed.

Where Paint remains installed, the action supported by the reporting is to update through the Store and then verify the versions. Where nobody needs Paint, removal is a consideration raised by Vitko, not a vendor-published workaround. Pursue the available update, account for every returned copy, and do not claim more certainty about exposure than Microsoft has published.

For the fleet patch task, include Paint's Store updates rather than waiting for Windows Update to deliver them. After the Store update, rerun both checks and close the task against the observed versions. Do not mark it complete merely because the operating-system update cycle has finished.