Updating Windows is not always enough to update its apps. For Paint vulnerability CVE-2026-83844, Microsoft identifies a fix distributed through the Microsoft Store and version 11.2609.401.0. The useful step is to check the app itself, then confirm that the update has actually been installed.
Another point deserves attention: in the current official data, the attack is described as local and requiring user interaction; the CVSS score is 7.0. The history indicates that Microsoft added a FAQ and updated the score on 7 November. This data therefore no longer matches the description of a network attack requiring no click, which is still reported in some articles.
An out-of-bounds read, a clarified assessment
An out-of-bounds read means that a programme accesses a memory area beyond the one it should use. In Paint’s case, Microsoft says that such a weakness could allow an attacker to execute code on the computer. This describes a software risk; it does not mean that any particular device has been attacked or compromised.
The security notice distinguishes the vulnerability’s title, which retains the phrase “Remote Code Execution”, from the conditions for exploiting it. In a FAQ, Microsoft explains that in this title, “remote” refers to the attacker’s location, while the action takes place locally on the victim’s machine.
The company gives as a general example the case of someone persuaded to download and then open a specially prepared file. The current attack vector is listed as local, with interaction required and high complexity. The latter term means that exploitation requires certain conditions and knowledge of the system; it does not mean that the vulnerability can be ignored.
The CVSS score is a technical indicator of severity, not a personal probability of being attacked. In the data consulted, Microsoft classifies the vulnerability as “Important” and reports no known exploitation. This indication reflects the status of the notice at the time of checking, not a guarantee about the future.
The number to check in Paint
The 6 November revision calls for installing version 11.2609.401.0 to fully address the vulnerability, or making sure that it has been installed automatically. A later version is also suitable; there is no need to try to go back to this exact number if the app is already newer.
To display the version, Clubic points to the settings icon in Paint, at the top right. If the version predates the patch, open the Microsoft Store and look for updates in the library or downloads, depending on the interface shown. After installation, return to Paint to check the number actually displayed.
This final check avoids confusing a search for updates that has been started with a fix that is actually present. The fact that a button has been clicked does not prove that the right app has been updated, that installation is complete or that the same version is available in every session on the PC.
Why the Store matters as much as Windows Update
Microsoft explains in its documentation that the Store automatically updates eligible apps, with exceptions for those updated directly by their publishers. A manual check is still possible, including when automatic updates have been paused.
On a device managed by a business or school, some settings may depend on the IT department. In that case, it is better to report the observed version of Paint to the relevant service than to change the machine’s policies at random. The channel that updates Windows and the one that distributes an app are not always interchangeable.
Clubic also draws attention to shared computers: other accounts may retain their own installation, and a copy prepared for new profiles may remain. For a computer fleet, the check must therefore cover the copies actually installed, not just the one visible in the session of the person carrying out the test.
Keep the security reference up to date
The changes to this notice illustrate a common difficulty: an article may accurately describe a notice as it stood on a given date, then become incomplete after a revision by the publisher. Microsoft’s history specifies a new version of Paint on 6 November and an update to the FAQ and the score on 7 November.
Two points should therefore be kept in mind together: the patched version and the current assessment of the vulnerability. Installing the patch remains the recommended measure; repeating an older, more alarming attack scenario does not improve it. The most practical check is still to look at Paint and the Microsoft Store, and, on a shared machine, the relevant installations.
References
- Microsoft fixes a flaw in Paint and the patch is in the Microsoft Store
- Microsoft October 2026 security data — CVE-2026-83844
- Get updates for apps and games in Microsoft Store
Office computer equipment. Illustrative photograph; it shows neither Paint nor a computer affected by the vulnerability.
Photograph: Andreas Schwarzkopf — Wikimedia Commons — CC BY-SA 4.0.
