Microsoft Paint RCE CVE-2026-83844 (CVSS 8.1): fix 11.2609.401.0 ships only via Microsoft Store; CVE/NVD list a different fixed build

Linha do tempo

1. darkreading.com ↗ · pub. 09/11/2026 18:12 · coletado 09/11 19:00 só resumo do feed

   Microsoft Patches Windows Paint RCE CVE-2026-83844, Fix Reaches Users Only via Microsoft Store

   ler a análise desta fonte ocultar

   Microsoft disclosed CVE-2026-83844 on October 13, 2026, a flaw in the Windows Paint app that can let an unauthenticated attacker run code over a network. Microsoft rates it Important with a CVSS 3.1 base score of 8.1 (thehackernews.com, citing msrc.microsoft.com). The flaw is an out-of-bounds read, and the vendor says exploiting it requires a deep understanding of the target system, which limits how easily it can be weaponized. At publication it was not known to be exploited or publicly disclosed, and it was absent from CISA's KEV catalog when checked (thehackernews.com). The fix reaches users only through the Microsoft Store, and Microsoft's own records disagree on the fixed version, which explains the weeks of confusion in the article.

   Technical Details

   • The advisory describes an out-of-bounds read that lets a crafted packet sent to an affected service over the network trigger code execution, but it does not name the service (thehackernews.com).
   • No sign-in and no user assistance are required for exploitation (thehackernews.com).
   • The CVE record and the NVD entry still list Paint as affected only below build 11.2605.91.0, which contradicts the advisory's fixed build (thehackernews.com).

   Fix Details

   • Microsoft's advisory names Paint build 11.2609.401.0 as the fixed version. The Microsoft Store offers this build, and Windows Update does not deliver it (thehackernews.com).
   • Brian Vitko of RFF checked six countries and found the newest Store build in each was 11.2605.81.0, which lacks the fix. His test virtual machine later moved to the fixed build through Store auto-update, but how fast other PCs will receive it is unclear (thehackernews.com).
   • No public pull request or commit for this fix was found in the pages opened; the patch is a closed Store package.

   Remediation

   • Update Paint through the Microsoft Store, or let auto-update install build 11.2609.401.0. In Intune and similar tools, a Store app update scan can push it across many PCs (thehackernews.com).
   • Check every user's copy of Paint and the provisioned copy, because a check of only the signed-in account can miss older installs. Confirm every copy shows 11.2609.401.0 or later, and do not rely on the CVE record's range (thehackernews.com).
   • The advisory lists no workaround. Vitko suggested removing Paint where nobody needs it, for all users and from the provisioned copy, but he did not test that step (thehackernews.com).

   Conflicting Reports

   • The article says the patch messaging was unclear. Per a Microsoft Q&A question cited by The Hacker News, the advisory gave 11.2605.91.0 as the fixed build until recently, and its revision history does not note the change (thehackernews.com). The current advisory names 11.2609.401.0 and is the more authoritative version.
   • The CVE record and NVD still list the affected range below 11.2605.91.0, so they disagree with the current advisory (thehackernews.com).
2. thehackernews.com ↗ · pub. 06/11/2026 09:06 · coletado 06/11 10:00

   Microsoft Paint RCE CVE-2026-83844: fix 11.2609.401.0 reaches the Microsoft Store only, CVE record lists a different fixed build

   The fix is now live in the Microsoft Store as build 11.2609.401.0 and is not delivered by Windows Update. The article also reports that the advisory changed its fixed build from 11.2605.91.0 without a revision note, while the CVE record and NVD still show 11.2605.91.0. It adds per-user and provisioned-copy check commands, confirms the flaw was not in CISA KEV on November 6, and notes that the Store was still serving 11.2605.81.0 earlier in the week.

   ler a análise desta fonte ocultar

   The fix is now live in the Microsoft Store as build 11.2609.401.0 and is not delivered by Windows Update. The article also reports that the advisory changed its fixed build from 11.2605.91.0 without a revision note, while the CVE record and NVD still show 11.2605.91.0. It adds per-user and provisioned-copy check commands, confirms the flaw was not in CISA KEV on November 6, and notes that the Store was still serving 11.2605.81.0 earlier in the week.

   A fix for CVE-2026-83844, an out-of-bounds read in Windows Paint that can lead to remote code execution, is now in the Microsoft Store. Windows Update does not deliver it. The fixed build, 11.2609.401.0, was the newest Paint build in all ten countries The Hacker News checked (thehackernews.com). Microsoft rates the flaw Important, CVSS 8.1, and says exploitation needs deep knowledge of the target system. It was not known to be exploited or publicly disclosed when published on October 13, and it was not in CISA KEV at the time of writing. The advisory and the CVE/NVD records disagree on the fixed build, so scanners may give inconsistent results.

   Technical Details

   • The advisory says an attacker could send "a specially crafted packet to an affected service over the network" with no sign-in and no user interaction. It does not name the service.
   • Paint is installed per user account, and Windows can keep a provisioned copy for new users. Checking only the signed-in account can miss older copies.
   • Brian Vitko of RFF found the Store offering 11.2605.81.0, which has no fix, in six countries earlier in the week. His test VM later moved to the fixed build through Store auto-update. That is one machine, so the rollout speed for other PCs is unclear.

   Remediation

   • Run in an elevated PowerShell: Get-AppxPackage -AllUsers -Name Microsoft.Paint | Select-Object Version, @{ n = 'Users'; e = { $_.PackageUserInformation.UserSecurityId.Username -join ', ' } } and Get-AppxProvisionedPackage -Online | Where-Object DisplayName -eq 'Microsoft.Paint' | Select-Object Version.
   • Update every copy below 11.2609.401.0 through the Store or Store auto-update. In Intune and similar tools, the Store app update scan does this at scale. Then re-run both commands to verify.
   • The advisory lists no workaround. Vitko suggested removing Paint where it is not needed, for all users and from the provisioned copy. He did not test this.

   Conflicting Reports

   The Microsoft advisory names 11.2609.401.0 as fixed. The CVE record and the NVD entry still list Paint as affected only below 11.2605.91.0. The advisory gave 11.2605.91.0 as recently as last week (per a Microsoft Q&A forum question), and its revision history shows no note about the change.

3. gbhackers.com ↗ · pub. 06/11/2026 02:33 · coletado 06/11 04:00

   Microsoft Paint CVE-2026-83844 out-of-bounds read enables unauthenticated remote code execution (CVSS 8.1); fixed in Paint 11.2609.401.0

   The gbhackers.com article adds the disclosure date (October 13, 2026), the temporal score of 7.1 (exploit maturity Unproven, official fix, confirmed report), and the full CVSS vector. It also states that the advisory names no affected service, port or execution chain. It gives 11.2609.401.0 as the fixed build and points to inconsistent Microsoft Store update availability.

   ler a análise desta fonte ocultar

   The gbhackers.com article adds the disclosure date (October 13, 2026), the temporal score of 7.1 (exploit maturity Unproven, official fix, confirmed report), and the full CVSS vector. It also states that the advisory names no affected service, port or execution chain. It gives 11.2609.401.0 as the fixed build and points to inconsistent Microsoft Store update availability.

   Microsoft disclosed CVE-2026-83844 on October 13, 2026. It is an out-of-bounds read (CWE-125) in Windows Paint that can lead to remote code execution. Microsoft rates it Important, with a CVSS 3.1 base score of 8.1 and a temporal score of 7.1. Microsoft says exploitation needs no authentication and no user interaction. Attack complexity is high, and Microsoft reported no exploitation and assessed it as "less likely" at publication. That limits the real risk.

   Technical Details

   • The CVSS vector is network attack vector, high attack complexity, no privileges, no user interaction, unchanged scope, and high confidentiality, integrity and availability impact.
   • The article says an attacker sends a specially crafted packet to an affected service. The advisory does not identify the service, the port or the execution chain.
   • Temporal metrics are exploit maturity "Unproven", remediation "Official Fix" and report confidence "Confirmed".
   • Microsoft says exploitation depends on environmental conditions, configuration and other security measures, and needs deep system knowledge.

   Remediation

   • Update Paint to build 11.2609.401.0, the build the article says the advisory lists.
   • Paint is serviced through the Microsoft Store, so OS patch status is not enough. Check installed app versions directly.
   • The article cites recent reporting of inconsistent update availability through the Store.
   • Prioritize finding outdated Paint installations in October security-update reviews.

   This summary rests on the article alone. No primary source was opened.

4. securityonline.info ↗ · pub. 05/11/2026 23:55 · coletado 06/11 00:00 primeiro registro

   Microsoft Paint RCE CVE-2026-83844 (CVSS 8.1) patched; fixed in Paint 11.2609.401.0, no exploitation seen

   ler a análise desta fonte ocultar

   Microsoft patched CVE-2026-83844, an out-of-bounds read (CWE-125) in Windows Paint that can lead to remote code execution. It is rated Important with a CVSS 8.1 score. Microsoft reports no known exploitation and no public exploit code (securityonline.info), and it assesses exploitation as "less likely". Attack complexity is high, which limits the real risk.

   Technical Details

   • The flaw is an out-of-bounds read (CWE-125) in the way Paint handles data. The article says a crafted packet sent over the network triggers it. Search results (sentinelone.com, cybernews.com) describe a specially crafted image instead, so the trigger is unclear.
   • Per search results, the CVSS vector is network attack vector, no privileges, no user interaction, high attack complexity. These details come from search snippets only, because the MSRC page could not be read.
   • Per search results, the flaw is not in CISA KEV, and no CVE-specific IOCs or network signatures exist.

   Remediation

   • Update Paint through the Microsoft Store (Downloads section). Enterprise admins can push the update with central tools.
   • Paint is serviced through the Store, so a patched OS does not guarantee a patched Paint. Search results report that admins have trouble getting the fixed build.
   • Check the MSRC advisory for the current fixed build.

   Conflicting Reports

   The article's action line says to update to 11.2605.91.0, but its body says the fix is 11.2609.401.0. Search results also give 11.2609.401.0 as the fixed build and mention that Microsoft may have changed the number. The MSRC page could not be read to confirm.