Overview
- Microsoft disclosed CVE-2026-83844 on October 13 and rated the flaw Important with an 8.1 CVSS score; the bug is an out‑of‑bounds read that can allow remote code execution without user interaction.
- Microsoft delivered a Paint fix through the Microsoft Store rather than Windows Update, and the advisory now lists build 11.2609.401.0 as the patched version.
- Multiple testers and users report the fixed build has not appeared uniformly, with some Store storefronts offering older builds and at least one test VM auto‑updating to the fixed build on its own.
- The CVE/NVD entry and Microsoft’s advisory use different 'fixed build' thresholds, which can make scanners and antivirus tools misflag machines as vulnerable or patched.
- Administrators should check every per‑user and provisioned copy of Paint with the provided PowerShell commands and use the Microsoft Store or device‑management tools to push 11.2609.401.0 or later to all accounts, since the advisory lists no workaround and no in‑the‑wild exploitation is known.