Microsoft has fixed CVE-2026-83844, a Windows Paint flaw that could let an attacker run code over a network, The Hacker News reported on November 6. Only a Microsoft Store update carries the fix; Windows Update does not. On the day it checked, the outlet found build 11.2609.401.0 was the newest in all ten countries it tried. Microsoft calls it Important and scores it 8.1 on the CVSS scale.
The bug is an out-of-bounds read: Paint reads memory outside its intended area. Microsoft's advisory says an attacker needs no sign-in or user help, but must understand the target system deeply. Earlier this week, Brian Vitko of RFF, which makes device-management software, saw the Store offer unfixed build 11.2605.81.0 in six countries. His test machine has since updated itself; how fast other PCs follow is unclear. The advisory names 11.2609.401.0 as fixed. A Microsoft Q&A forum question says it named 11.2605.91.0 until last week, and its revision history shows no change. The CVE record and NVD still say 11.2605.91.0.
A scanner reading the CVE record would pass builds from 11.2605.91.0 up to below 11.2609.401.0, though they lack the fix. Patch status now depends on which channel and which record a tool trusts. Security leads can ask which tool reads which field, and who owns Store updates. Check every user's copy and the provisioned one.