Microsoft Paint CVE-2026-83844: Critical RCE Fix Released

Microsoft has released a security update for the Windows Paint application to address CVE-2026-83844, a remote code execution (RCE) flaw. The vulnerability involves an out-of-bounds read, potentially allowing an attacker to execute arbitrary code over a network if a user is tricked into opening a malicious file.

• Fixed Paint version: 11.2609.401.0.
• Vulnerability Type: Remote Code Execution (RCE).
• Distribution Method: Microsoft Store only.
• Update Mechanism: Manual intervention required (not via Windows Update).

How to Apply the Patch Unlike most Windows security patches, this fix is not delivered via standard Windows Update channels. Users must manually open the Microsoft Store, navigate to the 'Library' section, and trigger an 'Update all' or specifically update the Paint application to build 11.2609.401.0 to ensure the vulnerability is patched.

Understanding the Security Risk An RCE vulnerability is classified as critical because it can lead to full system compromise. Although Paint is a basic utility, it processes diverse image formats, making it a viable target for attackers trying to exploit parsing errors to gain a foothold on the host machine.

Impact on Organizations For IT administrators and general users, the reliance on the Microsoft Store for security-critical updates creates a unique challenge. Security policies must be updated to ensure that 'Store apps' are not neglected, as these applications can now serve as entry points for sophisticated exploits.