How to Update Microsoft Paint to Fix CVE-2026-83844 (Windows 11)

To update Microsoft Paint and fix CVE-2026-83844, open the Microsoft Store, go to Downloads, select “Check for updates” and install the Paint update. Then confirm that Paint shows version 11.2609.401.0 or later. This fix comes only through the Microsoft Store, not through the monthly Windows Update, so don’t assume your PC is already patched.

Quick summary

Item	Details
Vulnerability	CVE-2026-83844, Windows Paint Remote Code Execution
Severity	Important. CVSS 3.1 base score 7.0 (Microsoft, updated 7 November 2026)
Fixed Paint build	11.2609.401.0 (Microsoft, 6 November 2026)
How it is delivered	Microsoft Store app update, not Windows Update
Exploited?	Not exploited or publicly disclosed, per Microsoft; “Exploitation Less Likely”
Time needed	About 5 minutes per PC

What is CVE-2026-83844 in Microsoft Paint?

CVE-2026-83844 is an out-of-bounds read bug (CWE-125) in the Paint app that ships with Windows 11. Microsoft says it can let an attacker run code on a PC. Microsoft first published the advisory on 13 October 2026. On 6 November it added a new Paint build, 11.2609.401.0, to fully address the bug.

Also read: How to Disable Twitter Sound Effects On iPhone And Android?

Despite “Remote Code Execution” in the title, Microsoft’s FAQ says the attack itself happens locally. A typical case is an attacker persuading someone to download and open a specially crafted file. On 7 November Microsoft revised the CVSS score to 7.0, with a local attack vector, high attack complexity and user interaction required.

What you need before you start

• A Windows 11 PC with the Paint app installed.
• An internet connection and access to the Microsoft Store.
• For IT admins checking several PCs: an administrator PowerShell window or your device-management tool (such as Intune).

How to update Microsoft Paint: step by step

Step 1: Check your current Paint version

1. Open Paint from the Start menu.
2. Select the Settings (gear) icon at the top right of the Paint window.
3. Look under About Paint for the version number.

You can also go to Settings > Apps > Installed apps, select the three dots next to Paint, then Advanced options. The version is listed there. If it is lower than 11.2609.401.0, carry on.

Step 2: Update Paint from the Microsoft Store

1. Open the Microsoft Store.
2. Select Downloads at the bottom left. In older Store versions, this is called Library.
3. Select Check for updates (or Get updates).
4. If Paint appears in the list, select Update next to it and wait for it to finish.

You can also search for “Paint” in the Store and select Update on its page.

Step 3: Confirm the fix

Close Paint and open it again. Then repeat Step 1. The version should now be 11.2609.401.0 or higher. If it is, this bug is fixed on that PC.

Step 4 (IT admins): Check every user and the provisioned copy

Store apps are installed per user. On a shared or managed PC, one account may be updated while another still runs an old copy. In an administrator PowerShell window, run these commands to list every installed copy and the copy that is provisioned for new users:

Get-AppxPackage -AllUsers -Name Microsoft.Paint | Select-Object Name, Version
Get-AppxProvisionedPackage -Online | Where-Object DisplayName -eq 'Microsoft.Paint' | Select-Object DisplayName, Version

If any copy is below 11.2609.401.0, trigger a Store app update scan from your management tool, or update it on that account. Then run the commands again. On PCs with winget, winget upgrade --id 9PCFS5B6T72H --source msstore targets the Store version of Paint.

For businesses without a dedicated IT team, a managed IT service can track Store app versions alongside Windows patches, so fixes like this one don’t slip through.

Paint update not showing? Try these fixes

Problem	What to try
Store shows no update for Paint	Check again later. Store updates can roll out gradually. Make sure your Windows date and time are correct.
App updates are paused	In the Store, select your profile picture > Settings, and check whether app updates are paused under App updates.
Store is stuck or won’t download	Press Win + R, type wsreset.exe and press Enter to clear the Store cache. Then check for updates again.
Store itself is broken	Go to Settings > Apps > Installed apps > Microsoft Store > Advanced options, and use Repair (or Reset).
Pause option missing on a work PC	Your organisation manages app updates. Ask your IT team to push the Paint update.

Until every PC is updated, avoid opening image files from unknown emails, chats or download sites in Paint. That is the kind of trick Microsoft’s FAQ describes.

Why Windows Update does not fix this

Paint has been a Microsoft Store app on Windows 11 for some time, so Microsoft fixes it by releasing a new app build, not a Windows patch. Microsoft’s advisory lists the fix as a Store app download (build 11.2609.401.0). Installing the latest Windows update, such as the recent KB5127936 release, does not change your Paint version.

Other Store apps work the same way. This is a good moment to select “Check for updates” for all of them. For other common problems, see our Windows 11 issues and fixes guide. A recent Office example of a fix that needed a separate update was the Excel KB5002914 copy-paste bug.

Frequently asked questions

What is the latest safe version of Microsoft Paint?

Microsoft says build 11.2609.401.0 fully addresses CVE-2026-83844, so any version at or above that number has the fix.

Will Windows Update install the Paint fix automatically?

No. The fix comes through the Microsoft Store. If Store auto-updates are on and not paused, Paint may update by itself, but you should still check the version.

Is the Paint vulnerability being exploited?

Microsoft’s advisory says it was not publicly disclosed or exploited, and rates exploitation as “Less Likely”. Updating is still the safe choice.

Can I uninstall Paint instead of updating it?

Microsoft does not list a workaround for this CVE. Updating to 11.2609.401.0 is the official fix. Removing Paint is possible on PCs that don’t need it, but it is not a Microsoft-recommended mitigation.

Bottom line

The Paint bug is not known to be exploited, and it needs someone to open a crafted file. But it is easy to miss, because Windows Update will not fix it. Open the Microsoft Store, update Paint and confirm version 11.2609.401.0 or later. IT teams should check every user account too. While you are patching, make sure your browser is current as well. See our Chrome 157 update guide.

Sources

• Microsoft Security Response Center: CVE-2026-83844, Windows Paint Remote Code Execution Vulnerability
• Microsoft Store: Paint
• Microsoft Support: Get updates for apps and games in Microsoft Store
• Microsoft Support: Fix problems with apps from Microsoft Store

About The Author