Some Windows 11 users may still be running a vulnerable version of Microsoft Paint even though the Microsoft Store reports that no update is available, according to reports published on November 5 by Windows Latest and Techzine.
The issue concerns CVE-2026-83844, an out-of-bounds read that Microsoft says could let an unauthenticated attacker execute code over a network. Microsoft rates the flaw as Important, with a CVSS score of 8.1 and lists the attack complexity as high. The vulnerability does not require privileges or user interaction, according to the company’s security record.
Microsoft disclosed the flaw on October 13 and lists Paint version 11.2609.401.0 or later as fixed in its Security Update Guide. However, Windows Latest reported that a test PC with automatic Store updates enabled was still running version 11.2603.251.0, while Techzine cited administrator reports of the Store offering older builds, including 11.2605.81.0. Techzine said Microsoft initially listed 11.2605.91.0 as the patched version before the guide changed to 11.2609.401.0. The flaw was disclosed as part of Microsoft’s October Patch Tuesday security release.
The conflicting build numbers have left administrators uncertain about whether the update is being delivered unevenly or whether the earlier version number was incorrect. Microsoft has not publicly explained the discrepancy, and the reports did not identify evidence of active exploitation. The Paint app is updated through the Microsoft Store, separately from Windows’ monthly cumulative updates, so installing the October Windows update alone does not establish that the app has received the fix.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
