Remote Code Execution in Microsoft Paint (CVE‑2026‑83844) Fixed via Store Update Only
What It Is — Microsoft disclosed a remote code execution (RCE) vulnerability in the Windows Paint application (CVE‑2026‑83844). The flaw is an out‑of‑bounds read that can be triggered over the network, allowing an attacker to execute arbitrary code with the privileges of the user running Paint. Microsoft has released a patch in build 11.2609.401.0, but the update is delivered exclusively through the Microsoft Store; it is not pushed via the traditional Windows Update channel. The fix is currently available in all ten monitored countries. No public exploits have been observed, but the CVSS rating is expected to be high given the network‑based RCE potential.
Affected Products — Microsoft Paint (Windows 10, Windows 11) – build 11.2609.401.0 or later.
Why It Matters for Trust & Control Assurance — The patch‑delivery gap tests the Patch Management and Secure Configuration control objective: organizations must ensure that every software component receives security updates, regardless of the distribution channel.
Recommended Actions —
- Inventory Paint versions on all endpoints.
- If a device runs a version earlier than 11.2609.401.0, deploy the Microsoft Store update manually or via your endpoint‑management tool.
- Extend patch‑management policies to include Microsoft Store updates as a required source.
- Capture and retain evidence of the Store‑based patch deployment for audit readiness.
Source: The Hacker News