Windows Paint Flaw CVE-2026-83844: Update via the Store

The flaw

Microsoft describes it as an out-of-bounds read in Windows Paint that lets an unauthorized attacker execute code locally, rated CVSS 7.0. It needs local access and user interaction. Microsoft has seen no exploitation and rates it "less likely."

The confusing timeline

• October 13: Microsoft disclosed the bug, but the listed fix (11.2605.91.0) was not in the Store as of at least October 30.
• November 4: the advisory was corrected to 11.2609.401.0, while the Store still offered 11.2605.81.0.
• November 6: the correct version reached the Store.
• November 7: Microsoft changed the score from 8.1 network to 7.0 local with user interaction. The new FAQ describes tricking a victim into downloading and opening a crafted file, which fits an image editor that doesn't listen on the network.

What to do

1. Open Paint, go to Settings > About and confirm version 11.2609.401.0 or later.
2. If older, open Microsoft Store > Downloads > Check for updates.
3. Keep automatic Store app updates on; Microsoft says those users are already protected.
4. Don't open images or files from unknown sources.