Microsoft has shipped a fix for a security flaw in Paint, the drawing tool bundled with every copy of Windows — but the usual advice of "let Windows Update handle it" won't work here. The flaw, tracked as CVE-2026-83844, is an out-of-bounds read bug rated 8.1 out of 10 (Microsoft calls it "Important"). It was reported through a coordinated disclosure by an anonymous researcher, and Microsoft says it hasn't seen the flaw used in any real attack and the technical details were never made public before the fix shipped.
The complication is how Paint gets updated. On modern Windows, Paint isn't part of the core operating system anymore — it's delivered as an app through the Microsoft Store, the same way Notepad, Calculator, and the Snipping Tool now are. That means the regular Windows Update cycle that patches your OS, browser, and Office suite simply doesn't touch it. The fix, Paint build 11.2609.401.0, only reaches a machine when the Microsoft Store itself pushes an app update — and coverage has been inconsistent: as of 5 November, some Store catalogs were still only offering an older, vulnerable build even on machines set to update automatically.
What this means for your business
This isn't a "drop everything" incident — there's no known exploit and no sign anyone has used this flaw yet. But it's a useful prompt to check an assumption a lot of small business owners and even IT staff make: that "Windows Update is on, so we're covered." Several built-in Windows apps have quietly moved to Store-based delivery over the past few years, and Store updates don't always run on the same schedule, or as reliably, as OS patches do.
- Open the Microsoft Store on a few office machines, go to Library, and click "Get updates" — confirm Paint updates rather than assuming it already has.
- If an IT contractor or managed-service provider looks after your machines, ask them directly whether they track Microsoft Store app updates separately from Windows Update, not just whether "updates are automatic."
- If your business runs a fleet of Windows machines through a device management tool, this is worth a one-off manual push rather than waiting for the next scheduled patch cycle, since Store delivery timing has been inconsistent for this specific update.
The broader lesson travels well beyond Paint: as more of Windows' built-in tools move to app-store delivery, "fully patched" now means checking two update mechanisms instead of one.