Microsoft shipped a fix for a Paint bug that needs neither user interaction nor sign-in, then left administrators unable to get it through normal patch management.
What Paint is actually exposed to
Tracked as CVE-2026-83844, the flaw is an out-of-bounds read that can lead to code execution over the network. Microsoft rates it Important, CVSS 8.1, noting a successful attack requires deep knowledge of the target. The October 13 advisory lists no exploitation and no workaround, and the bug is not in the federal catalog.
Paint ships from the Microsoft Store rather than Windows Update, so the patch arrives through Store auto-update. That delivery path is where the trouble starts.
Two different build numbers
Microsoft’s advisory names 11.2609.401.0 as fixed. The CVE record and its NVD entry still say anything at or above 11.2605.91.0 is patched. A scanner reading the CVE would pass a build Microsoft now treats as vulnerable, and the revision history shows no note of the change.
Brian Vitko of RFF checked what the Store offered in six countries and found 11.2605.81.0 everywhere, a build without the fix. One test machine has since updated itself. Whether fleets will is unproven.
Check every copy, not the signed-in one
Store apps install per user account, and Windows can keep a provisioned copy applied to each new profile, so auditing only your own account misses older copies. In an elevated PowerShell window, list every user’s package plus the provisioned package, then find anything below 11.2609.401.0.
Push stale copies through the Store, or trigger the Store app update scan from Intune and similar tools, then re-run both commands. The only other option is removing Paint where nobody needs it, a step the researcher did not test. Given an 8.1 needing no credentials or clicks, quietly unpatched endpoints deserve inventory.
