Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It
CVE-2026-83844, an RCE in Windows Paint, is fixed only via the Microsoft Store — not Windows Update — meaning enterprises relying solely on WSUS will miss the patch entirely.
Summary written by editorial AI · Source link below
A fix for CVE-2026-83844, a remote code execution flaw in Windows Paint, is now in the Microsoft Store. Paint gets this fix only through a Store update, not through Windows updates.
The fixed build, 11.2609.401.0, was the newest Paint build in all ten countries The Hacker News checked today.
The flaw is an out-of-bounds read that could let an attacker run code over a network. Microsoft rates
Editorial Analysis
Enterprises that depend exclusively on WSUS or Windows Update for patch management have a blind spot: Store-only fixes for default applications can leave entire fleets exposed to known RCE vulnerabilities.
Verify that Microsoft Store updates are permitted and monitored across managed endpoints, or manually deploy Paint build 11.2609.401.0.
A remote-code-execution fix for a built-in Windows app is only available through the Microsoft Store, bypassing standard enterprise patching channels.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at THN (Feedburner) in a new tab.
More from the Vulnerabilities Desk
- SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks3d
- QNAP says hackers breaching NAS devices in Plex2Shell attacks3d
- Installing the Fix for an Exploited WordPress Flaw Can Expose Some Sites One Last Time3d
- [NEU] [mittel] JetBrains CLion: Mehrere Schwachstellen3d
- [UPDATE] [mittel] Keycloak: Mehrere Schwachstellen3d