The Microsoft Security Response Center has issued Revision 2.0 of its official security advisory for CVE-2026-83844, formally designating Microsoft Paint Store build 11.2609.401.0 as the required update to remediate a high-severity remote code execution vulnerability on Windows 11. The security flaw, originating from an out-of-bounds read vulnerability tracked under CWE-125, carries a Common Vulnerability Scoring System base score of 8.1 under CVSS 3.1 alongside a temporal score of 7.1, earning an Important severity rating from Microsoft. The revised advisory resolves weeks of operational uncertainty across enterprise IT environments, which arose when the initial fix cited in October security bulletins failed to appear in the public Microsoft Store repository. Missing Store Packages and Version Discrepancies Microsoft originally disclosed CVE-2026-83844 on October 13, 2026, as part of its monthly Patch Tuesday cycle. The vendor's initial Security Update Guide entry and corresponding CVE record identified Paint builds from 11.0.0.0 up to, but not including, 11.2605.91.0 as vulnerable, effectively designating build 11.2605.91.0 as the patched version. However, enterprise systems engineers attempting to validate the patch discovered that build 11.2605.91.0 was entirely absent from the public Microsoft Store delivery network.
Missing 11.2605.91.0 package and zero-click attack vector
Brian Vitko, a systems researcher at device-management software developer RFF, conducted an audit of Microsoft Store repositories across six countries earlier in the week and confirmed that the newest Paint package offered was unpatched build 11.2605.81.0. Independent tests by technology analysts revealed older endpoints actively running build 11.2603.251.0 despite having automatic updates enabled in Store settings. Because vulnerability scanners ingest raw advisory feeds from the CVE database and the National Vulnerability Database, automated compliance tools flagged endpoints across corporate environments, while administrators remained unable to obtain the non-existent 11.2605.91.0 package.
In response to widespread community inquiries on Microsoft Q&A and technical forums, Microsoft adjusted the target build in its Security Update Guide in early November to 11.2609.401.0. On November 6, 2026, Microsoft published Revision 2.0 of the advisory and synchronized the CVE record, formally noting that it released Paint build 11.2609.401.0 to comprehensively address the defect. Zero-Click Attack Vector and Enterprise Delivery Blind Spots According to Microsoft's advisory documentation, an unauthenticated attacker could exploit the vulnerability over a network by sending a specially crafted packet to an affected service, achieving arbitrary code execution without local user interaction or authentication credentials. The CVSS 3.1 vector evaluates the attack vector as network (AV:N), privileges required as none (PR:N), and user interaction as none (UI:N), while assigning high impacts across confidentiality, integrity, and availability. Nonetheless, Microsoft assessed attack complexity as high (AC:H) and rated exploitation as less likely, observing that reliable execution requires detailed knowledge of target system memory layout. The vulnerability has not been observed in active exploitation, does not appear in the CISA Known Exploited Vulnerabilities catalog, and carries an Exploit Prediction Scoring System probability of 0.73%.
Cybersecurity telemetry researchers noted that the flaw highlights an acute architectural blind spot in enterprise configuration management. Under Windows 11, Microsoft Paint operates as a packaged modern application (Store product ID 9PCFS5B6T72H) requiring build 22000 or later, decoupled from the core operating system image. As a result, applying standard cumulative operating system rollouts via Windows Update or Windows Server Update Services does not patch the Paint executable. In corporate fleets where administrators disable Microsoft Store connectivity or app auto-updates through Group Policy, endpoints remain exposed indefinitely. Furthermore, because Store applications deploy independently per user profile, multiple user sessions on shared workstations can harbor divergent software builds. Endpoint Fleet Audit and Administrative Mitigation Following backend catalog refreshes on November 5 and 6, verification testing across ten countries confirmed that the Microsoft Store now consistently distributes build 11.2609.401.0. Endpoint defense teams recommend immediate administrative audits to verify that all managed user accounts and base operating system images meet the updated threshold.
PowerShell audits and winget install for Paint build 11.2609.401.0
Security administrators should execute elevated PowerShell scripts across managed fleets. The Get-AppxPackage cmdlet queries installed package versions across all user profiles, while the Get-AppxProvisionedPackage cmdlet inspects the default application template provisioned for newly created accounts. Workstations displaying versions below 11.2609.401.0 should trigger an immediate Store refresh or execute a silent installation via the Windows Package Manager winget utility targeting product ID 9PCFS5B6T72H.
Security operations centers can also monitor Windows event logs for Application Error event 1000 entries involving mspaint.exe, where an access violation code of 0xc0000005 may signal failed exploitation attempts. In locked-down production environments or sensitive jump hosts where Store servicing cannot be maintained, analysts advise administrators to completely deprovision and remove the Microsoft Paint application package, thereby eliminating the residual attack surface.
