Microsoft Paint Flaw Lets Remote Code Run on Windows 11 but Many PCs Still Unpatched

Overview

• Microsoft disclosed a high‑severity remote code execution vulnerability in Paint tracked as CVE-2026-83844 that can let attackers run code on Windows 11 without elevated privileges.
• The company says exploitation is complex and that it has seen no signs of active attacks, but the flaw carries a CVSS score of 8.1 and can be triggered over the network without user interaction.
• Microsoft published a fix for the Store version of Paint identified as v11.2609.401.0 and recommends updating to that release to close the hole.
• Multiple users and IT administrators report the Store update is not appearing or not installing, leaving many systems on older Paint builds and forcing manual checks of the app version.
• As a practical step, affected users can uninstall the Store Paint app or verify the installed version with PowerShell while enterprises should note that Store apps update separately from Windows Update and may need manual distribution or removal.