A Microsoft Store catalog query at 04:14 UTC on November 6 lists Paint 11.2609.401.0 in the US, UK and Germany, according to RFF. The Hacker News reported that Microsoft’s advisory identifies 11.2609.401.0 as the fixed build for CVE-2026-83844. A catalog listing records the Store offer; device-level inventory is needed to determine which Paint version is installed on a particular PC.
What CVE-2026-83844 describes
The public CVE record describes an out-of-bounds read, classified as CWE-125, in Windows Paint that could allow remote code execution over a network. It assigns the vulnerability a CVSS 3.1 score of 8.1. Its scored scenario has a network attack vector and high attack complexity, with no privileges or user interaction required.
Microsoft’s advisory wording, quoted by The Hacker News on November 6, describes an unauthenticated attacker sending a specially crafted packet over the network to an affected service.
How Paint’s update reaches a PC
Reports from The Hacker News and RFF describe the Paint fix as an app update delivered through Microsoft Store, separately from Windows cumulative updates. Updating Windows itself therefore does not establish that Paint has the reported build.
Paint can have separate registrations for individual user profiles, as well as a provisioned package used for new profiles. A package inventory limited to one signed-in user can miss another profile’s Paint registration or the provisioned copy.
The two dated Store catalog checks
RFF reported these results from catalog queries on consecutive days:
| Catalog check (UTC) | Markets named | Paint version |
| November 5, 03:34 | US, UK, Germany, Australia, India and Singapore | 11.2605.81.0 |
| November 6, 04:14 | US, UK and Germany | 11.2609.401.0 |
