Security · High impactFan score 43 · Tier B3 sources57 comments in the community

Microsoft Fixes RCE Bug in Windows Paint After Weeks of Confusion

Dark Reading · By Alexander Culafi · 3h ago

The Brief · written from 3 sources

Microsoft disclosed CVE-2026-83844, a remote code execution flaw in Windows Paint.
The fix is delivered only through a Microsoft Store update, not through Windows Update.
The fixed Paint build is 11.2609.401.0, reported as the newest Paint build in all ten countries checked.

Why it matters

Paint users who installed it from the Microsoft Store need that Store update to get the fix, and Windows Update alone will not deliver it.

Who’s affected

Windows users running the Microsoft Store version of Paint

What to do

Update Paint through the Microsoft Store to build 11.2609.401.0 or later

Microsoft Paint 11.2609.401.0
CVE-2026-83844
#security
#windows
#microsoft-paint
#rce
#vulnerability

Last month, Microsoft disclosed a vulnerability in Microsoft Paint, but messaging regarding a patch was unclear.

Read the full story at darkreading.com ↗

What developers are saying

Based on 57 comments · Mixed reactions

Commenters are largely incredulous that MS Paint could have a remote code execution flaw, and many joke about it. Several question the CVSS vector, especially the no-interaction score, and note that the fix arrives via the Store rather than Windows Update.

Surprise that Paint has RCE30%
Doubts about CVSS vector20%
Jokes about Microsoft and old apps25%
Store versus Windows Update delivery15%
Air-gapped security reflections10%

In favour

+ The CVE record names a specific fixed version, 11.2609.401.0, which makes remediation clear
+ Some commenters running much older Paint versions think they may be safe