The fix for CVE-2026-83844, an 8.1 out-of-bounds read in Windows Paint, ships only as a Microsoft Store update (build 11.2609.401.0), not through Windows Update, The Hacker News reports.
The catch
Microsoft’s advisory says 11.2609.401.0 is fixed, but the CVE record and NVD still say anything from 11.2605.91.0 up is fixed. A scanner reading the CVE could pass a vulnerable build. Paint is also installed per user, and there may be a provisioned copy for new users, so checking only the signed-in account can miss old copies.
Check it
In an admin PowerShell: Get-AppxPackage -AllUsers -Name Microsoft.Paint and Get-AppxProvisionedPackage -Online | ? DisplayName -eq Microsoft.Paint. You want 11.2609.401.0 or later.
My take
Store apps are patch-management blind spots. Make sure your tooling actually looks at them.
God Bless, and May the Source Be with You!
