Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It

A fix for a remote code execution vulnerability in Windows Paint is available through the Microsoft Store. The updated Paint build, version 11.2609.401.0, can be obtained from the Store, but not through Windows updates. This vulnerability is caused by an out-of-bounds read that could allow an attacker to execute code remotely. The fixed build is currently available in multiple countries. Microsoft has assigned the vulnerability the identifier CVE-2026-83844. The company has rated the severity of this flaw.