Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It

A remote code execution vulnerability, CVE-2026-83844, exists in Microsoft Paint due to an out-of-bounds read flaw that could allow an attacker to execute code over the network without authentication or user interaction. The fix is available via the Microsoft Store as build 11.2609.401.0 but is not distributed through Windows Update, leading to potential inconsistencies in patch deployment. Microsoft rates the vulnerability as Important with a CVSS score of 8.1, and it was not under active exploitation at the time of disclosure. Organizations are advised to manually verify and update all user-specific and provisioned instances of Paint to ensure full remediation.

AI-extracted · verify before operational use