Microsoft has released a fix for CVE-2026-83844, a remote code execution vulnerability in Windows Paint, available exclusively through a Microsoft Store update rather than Windows Update. The patched version is 11.2609.401.0, but many systems may still run older versions, requiring administrators to verify and update each user’s Paint installation via PowerShell commands. Microsoft rates the flaw as important with a CVSS score of 8.1, noting exploitation requires specialized knowledge, and no exploitation has been reported to date.
https://thehackernews.com/2026/11/microsoft-paint-rce-fix-now-available.html