# Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It

Source: [The Hacker News](https://thehackernews.com/2026/11/microsoft-paint-rce-fix-now-available.html) · 2026-11-06 · Security
Page: https://themorning.dev/story/microsoft-paint-rce-fix-now-available-but-windows-update-won-t-deliver-it-649e0d8b078ebcc3
Kind: security · Impact: high

## In brief

- Microsoft disclosed CVE-2026-83844, a remote code execution flaw in Windows Paint.
- The fix is delivered only through a Microsoft Store update, not through Windows Update.
- The fixed Paint build is 11.2609.401.0, reported as the newest Paint build in all ten countries checked.

## Why it matters

Paint users who installed it from the Microsoft Store need that Store update to get the fix, and Windows Update alone will not deliver it.

## What to do

- Update Paint through the Microsoft Store to build 11.2609.401.0 or later

## Versions

- Microsoft Paint 11.2609.401.0

## CVEs

- CVE-2026-83844

## Timeline

- 2026-11-05: CVE-2026-83844 disclosed
- 2026-11-06: Fix made available in the Microsoft Store (build 11.2609.401.0)

## What developers say

Commenters are largely incredulous that MS Paint could have a remote code execution flaw, and many joke about it. Several question the CVSS vector, especially the no-interaction score, and note that the fix arrives via the Store rather than Windows Update. (sentiment: mixed)

> Had to go to Microsoft Store to get the fixed version, Windows Update didn't show anything. — greyhound1, Hacker News

> WHY ON HELL paint has a remote code execution in the name of God? — xlayn, Hacker News

> Paint can exectue arbitrary code from the REMOTE, without USER INTERACTION????? — pasteleft, Hacker News

## Coverage

- [Microsoft Fixes RCE Bug in Windows Paint After Weeks of Confusion](https://www.darkreading.com/application-security/microsoft-rce-bug-windows-paint-confusion) — darkreading, 2026-11-09
- [Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It](https://thehackernews.com/2026/11/microsoft-paint-rce-fix-now-available.html) — The Hacker News, 2026-11-06
- [MS Paint Remote Code Execution Vulnerability](https://www.cve.org/CVERecord?id=CVE-2026-83844) — Hacker News: Front Page, 2026-11-05

## Discussions

- [Hacker News](https://news.ycombinator.com/item?id=50384233): 215 points, 57 comments

Tags: security, windows, microsoft-paint, rce, vulnerability

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev