Microsoft Paint RCE Vulnerability Requires Manual Microsoft Store Update
A critical remote code execution flaw in Windows Paint necessitates specific application store updates.
1Remote Code Execution Risk
Microsoft identified a critical remote code execution vulnerability, tracked as CVE-2026-83844, within the Windows Paint application. This out-of-bounds read flaw allows attackers to execute arbitrary code over a network without requiring user interaction or authentication. The company currently rates this security vulnerability as Important, assigning it a CVSS score of 8.1.
2Store Update Mechanism
Unlike standard Windows system patches, the fix for this vulnerability is delivered exclusively through the Microsoft Store. Users must ensure their Paint application is updated to build 11.2609.401.0 to mitigate the risk. Relying on standard Windows Update processes will not resolve this specific security flaw, creating potential gaps for unmanaged systems.
3Version Discrepancy Challenges
Security researcher Brian Vitko observed that earlier builds, such as 11.2605.81.0, remained vulnerable across multiple countries. While Microsoft’s advisory now points to build 11.2609.401.0 as the definitive fix, previous documentation suggested version 11.2605.91.0. This inconsistency complicates verification for administrators who rely on automated scanners to detect patched software versions across enterprise environments.
4Multi-User Installation Complexity
Paint is installed per user account, meaning a single PC may host multiple versions simultaneously. Administrators must check both active user accounts and provisioned packages to ensure full compliance. Using PowerShell commands like Get-AppxPackage and Get-AppxProvisionedPackage is necessary to identify every instance of the application installed on a machine.
5Attack Vector Characteristics
The vulnerability allows an attacker to exploit the system by sending a specially crafted packet to an affected service over the network. Microsoft notes that a successful attack requires a deep understanding of the target system architecture. No specific workaround or mitigation strategy was provided in the official security advisory documentation.
6Exploitation Status Update
As of October 13, the flaw was not known to be publicly disclosed or actively exploited in the wild. Furthermore, the vulnerability does not currently appear in the Known Exploited Vulnerabilities catalog maintained by the U.S. Cybersecurity and Infrastructure Security Agency. This suggests a proactive discovery rather than a reactive response.
7Verification and Compliance
While some virtual machines may receive the update automatically via Store background processes, the speed of deployment across the broader user base remains unclear. Organizations should manually verify build versions on all endpoints. If immediate patching is not possible, removing the application for all users remains a suggested, albeit untested, precaution.
8Security Operations Context
This incident highlights the challenges of managing security for modern application store packages within Windows environments. Security teams must treat Store-based applications as distinct attack surfaces that operate outside traditional patch management cycles. Continuous monitoring of application-specific versioning is essential to maintain visibility and prevent exploitation of these critical software components.