Paint's RCE fix has 2 build numbers. Only 1 is real

Microsoft's Paint remote code execution flaw, CVE-2026-83844, has two different fixed builds depending on which Microsoft document you read. The CVE record says anything from 11.2605.91.0 is fixed. Microsoft's own security data says the fix is 11.2609.401.0. I downloaded both records and checked: the 11.2605.91.0 build never shipped, and the real fix only reached the Microsoft Store today — 24 days after the flaw was published.

The flaw, as Microsoft describes it

CVE-2026-83844 is an out-of-bounds read (CWE-125) in Windows Paint, published October 13, 2026. CVSS 8.1, rated Important, impact remote code execution. The vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, no authentication, no user interaction, high attack complexity. Microsoft's FAQ says an unauthenticated attacker could exploit it "by sending a specially crafted packet to an affected service over the network." It does not name the service, the port, or the protocol. There is no proof of concept, no exploit code, and no researcher credit — the acknowledgment is "Anonymous." Microsoft lists it as not publicly disclosed, not exploited, "Exploitation Less Likely," and it is not in CISA's Known Exploited Vulnerabilities catalog — I checked all 1,768 entries, zero hits. NVD still lists the record as "Undergoing Analysis" with no CPE range published.

So far, a standard Important RCE with a thin public record. The interesting part is the patch.

Two fixed builds

The CVE record on cve.org, last updated October 31, lists Paint as affected from 11.0.0.0 up to — but not including — 11.2605.91.0. Read plainly, that says 11.2605.91.0 is the fixed build.

Microsoft's October 2026 CVRF — the machine-readable security data I downloaded directly from api.msrc.microsoft.com (47.8 MB) — says something else for the same CVE. The remediation entry for product 22026, which the product tree names "Microsoft Paint," reads:

Remediation:     Vendor Fix
Description:     Store App
FixedBuild:      11.2609.401.0
URL:             https://apps.microsoft.com/detail/9pcfs5b6t72h
RestartRequired: Maybe
Customer Action Required: Yes

The revision history in that same document has exactly one entry — 1.0, dated October 13. No revision notes the build number changing. So the CVE record and the CVRF disagree, and the CVRF does not explain why. A scanner that reads the CVE record will call any build from 11.2605.91.0 upward fixed. The build Microsoft's own data names as fixed is 11.2609.401.0.

The fix didn't exist in the Store until today

Paint is a Store app, so the fix does not come through Windows Update. It comes when the Store updates Paint — per user account, plus a provisioned copy for new users, which is why fleet checks have to enumerate every installed copy.

The timeline, as documented by RFF's Brian Vitko, who queried the Store's own product catalog: on November 5 at 03:34 UTC, the newest Paint in the Store in the US, UK, Germany, Australia, India, and Singapore was 11.2605.81.0 — below both numbers Microsoft has called fixed. At 04:14 UTC on November 6, the same query returned 11.2609.401.0. His lab VM picked it up through Store auto-update the same morning. The 11.2605.91.0 build from the CVE record never showed up anywhere.

That is the part worth sitting with. The flaw was published October 13. For 24 days, no fixed build was available in the Store at all — and during that window, the CVE record named a fixed build that did not exist. Anyone who checked their fleet against the CVE record during those three weeks would have concluded they were waiting for a build that was never going to arrive, while anyone who checked the Store would have found nothing newer than an unfixed build.

What to actually check

Go by 11.2609.401.0, the build in Microsoft's CVRF data — not 11.2605.91.0 from the CVE record. Check every user account's copy and the provisioned copy, not just one install; Store apps install per user, and a scanner that looks at one copy will miss the others. And do not assume Windows Update handled it: this one only arrives through the Store, so a fully patched machine can still be running a vulnerable Paint if Store auto-update is off or hasn't run. There is no workaround or mitigation listed in the advisory — verified patch installation is the only documented remediation.

The deeper problem is not this one CVE. It is that the two canonical sources for the same vulnerability disagreed about the fix for three weeks, with no revision note, and the record most scanners consume was the wrong one. If your fleet tooling reads CVE records, this is a case where it would have reported "fixed" for a build that never shipped, on machines that were never patched.

Sources: CVE record for CVE-2026-83844 (cve.org, published 2026-10-13, updated 2026-10-31); Microsoft October 2026 CVRF via api.msrc.microsoft.com (FixedBuild 11.2609.401.0, product 22026 "Microsoft Paint"); MSRC Security Update Guide API (severity Important, temporal score 7.1, "Exploitation Less Likely"); NVD (Undergoing Analysis); CISA KEV feed (1,768 entries, no match). The Store catalog timeline (Nov 5: 11.2605.81.0; Nov 6 04:14 UTC: 11.2609.401.0) is from RFF's published check, and the "fix only via Store, not Windows Update" reporting is from The Hacker News — both attributed, not my own measurements. Everything else above I fetched and verified myself on 2026-11-06.