CVE-2026-83844: Microsoft Paint Patch Is Store-Only, Windows Update Isn't Enough

The fix for CVE-2026-83844 in Microsoft Paint (CVSS 8.1) ships exclusively via the Microsoft Store. Enterprise environments that block the Store or rely solely on Windows Update remain exposed.

On November 6, 2026, Microsoft released Paint build 11.2609.401.0, which fixes CVE-2026-83844, an RCE vulnerability rated CVSS 8.1. The update is distributed exclusively through the Microsoft Store and does not appear in traditional Windows Update channels. The consequences are immediate: enterprise environments that block the Store or rely on CVE-data-based vulnerability scanners risk reporting systems as "compliant" while they are actually running vulnerable code.

Key Takeaways

CVE-2026-83844 in Microsoft Paint carries a CVSS 8.1 rating and is classified Important by Microsoft; the patch is available only via the Microsoft Store (build 11.2609.401.0), not Windows Update.
Microsoft initially listed build 11.2605.91.0 as the fixed version, but that build never appeared in the public Store catalog; the advisory was updated on November 6 without documenting the revision in its history.
Paint is an MSIX/Appx app installed per user profile; traditional patching via cumulative updates (LCU) does not touch it, creating an operational blind spot for enterprises.
Environments with the Store or auto-update blocked via GPO/MDM remain exposed indefinitely; no official workarounds or mitigations exist from Microsoft.

The Architectural Gap That Makes Paint Invisible to Traditional Patching

The separation between Windows Update and the Microsoft Store is not new, but CVE-2026-83844 exposes it with operational clarity. Paint is classified as an inbox app, yet it is distributed in MSIX/Appx format through the Store channel. Its update mechanism is managed by a service distinct from the Windows Update Agent that delivers system cumulative updates. This means the October 2026 Patch Tuesday did not include any component touching Paint.

The result is a security perimeter inconsistency. A Windows 11 system with all cumulative updates installed and "green" compliance dashboards can still host a vulnerable version of Paint. InfoSecMonkey captured the problem in a formula worth noting: "You can be 100 percent green on Windows Update compliance and still have a vulnerable Paint on every desktop in the building."

The Build Discrepancy and the Risk of Stale CVE Data

The patch's path is marked by documented confusion that amplifies the risk of false negatives in scanning systems. Microsoft initially listed build 11.2605.91.0 as the fixed version in the MSRC advisory. SQ Magazine verified that "no public source shows that 11.2605.91.0 ever shipped through the Store." The Hacker News corroborated the absence of that build from the public catalog.

The advisory was subsequently updated to build 11.2609.401.0 on November 6, with a revision note dated November 6, 2026, according to ThreatDefence. The NVD record and the CVE.org record updated the affected range to 11.0.0.0 < 11.2609.401.0. However, the time gap between the initial vulnerability publication (October 13) and the actual availability of the fixed build left room for misaligned technical information.

The Hacker News flagged the specific risk: "A tool that reads the CVE record would treat any build from 11.2605.91.0 upward as fixed, even though Microsoft's advisory sets the bar higher." This means automated scanners, asset inventory tools, and vulnerability management platforms configured on CVE data — without cross-checking against the real Store catalog — can classify builds as safe that do not contain the actual patch.

Who Is Exposed and Why Store Distribution Doesn't Guarantee Uniform Coverage

Microsoft Store distribution introduces variables that traditional patching does not account for. Brian Vitko of RFF verified early in the week that in six countries (United States, United Kingdom, Germany, Australia, India, Singapore) the latest available build was still 11.2605.81.0, lacking the fix. The Hacker News extended verification to ten countries on November 6, confirming availability of 11.2609.401.0. Fleet-wide propagation timelines remain uncertain.

Exposure is highest in three enterprise scenarios: environments with the Microsoft Store blocked via Group Policy or MDM; kiosk systems or servers with Desktop Experience where Store auto-update is disabled; infrastructures that do not track per-user Store app versions. In all these cases Paint "stays on the vulnerable build indefinitely," as ThreatDefence documents.

The problem is further complicated by the per-profile nature of the installation. Paint is distributed as a separate appx for each user account; a provisioned copy also exists for new profiles. This means that even on a system where one user has received the update, another account or a new login can present the vulnerable version.

"Paint gets this fix only through a Store update, not through Windows updates" — The Hacker News

What to Do Now

Operational actions must address the dual nature of the problem: verifying the actual build and removing blocks to Store distribution for this specific app.

Run Get-AppxPackage -AllUsers Microsoft.Paint to enumerate all installed instances and compare the version against build 11.2609.401.0; repeat with Get-AppxProvisionedPackage to verify the system copy.
Use winget list --name Paint or equivalents for tracking Store versions across the fleet, integrating this data into vulnerability management reports.
Verify that GPO/MDM policies blocking the Microsoft Store or its auto-updates do not prevent receipt of the fixed build; evaluate targeted exceptions for Microsoft.Paint if the organization operates under a total block.
Align vulnerability scanner data with the updated CVE record (affected range 11.0.0.0 < 11.2609.401.0 per NVD and CVE.org) and verify they do not apply the obsolete 11.2605.91.0 threshold.

Why This Case Challenges the Traditional Patch Management Model

CVE-2026-83844 is not extraordinary in its theoretical impact: Microsoft assesses exploitation as "Less Likely" and it does not appear in the CISA KEV catalog. Its value as a case study lies instead in breaking the assumption that "Windows Update current = system protected." When an inbox app like Paint falls outside the cumulative update perimeter, the entire chain of tools and processes built on that assumption generates false negatives.

Microsoft's silence on the advisory revision — the build change without explicit documentation in the history — adds a layer of opacity that complicates independent verification. Organizations must now integrate Store app tracking into the vulnerability management lifecycle, with specific per-user profile controls and cross-verification between CVE records and real distribution catalogs. The "false sense of security" is no longer an abstract risk: it is a green dashboard with a vulnerable build running.

FAQ

Does the vulnerability require user interaction to be exploited?: No. The CVSS vector indicates UI:N (User Interaction: None) and PR:N (Privileges Required: None). Microsoft has not, however, clarified the exact network service that receives the malicious packet.
Why is build 11.2605.91.0 relevant if it was never distributed?: Because it was listed as fixed in the initial CVE records. Automated scanners and vulnerability management tools configured on that data classified builds as safe that did not contain the actual patch, generating false negatives.
Is Windows 10 with classic Paint vulnerable?: No. Windows 10 with the classic version of Paint (non-MSIX/Appx) is not listed as an affected system in the Microsoft advisory.

Sources

Sources and references

Get DeafLetter