Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It
Microsoft releases Paint RCE fix via Store only; Windows Update won't deliver CVE-2026-83844 patch.
Microsoft has released a fix for CVE-2026-83844, a critical remote code execution vulnerability in Windows Paint (CVSS 8.1), but only through the Microsoft Store—not via traditional Windows Update. The flaw, an out-of-bounds read affecting Paint builds below 11.2609.401.0, allows network-based code execution without user interaction. Administrators must manually verify and deploy the Store update across all user accounts and provisioned copies to ensure complete remediation.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA critical remote code execution vulnerability in Windows Paint (CVE-2026-83844, CVSS 8.1) exposes systems to network-based attacks requiring no user interaction—a particularly dangerous threat profile. Microsoft chose to distribute the fix exclusively through the Microsoft Store rather than Windows Update, breaking the standard automated patching workflow that most organizations rely on. This means that even diligent IT teams with fully automated Windows Update policies are unknowingly leaving systems unpatched. The incident highlights a growing risk when vendors use fragmented update delivery channels, as security teams cannot assume a single patching pipeline covers all installed software.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-83844