Windows Paint Fix Reaches Store: Verify Every User Copy and Provisioned Package

A corrected Windows Paint build has reached the Microsoft Store, according to a November 6 update from RFF’s Brian Vitko. For administrators tracking CVE-2026-83844, the remaining task is to verify what is actually installed across user profiles and what new profiles will receive.

Vitko’s catalog checks and lab observations found Paint 11.2609.401.0 available in the US, UK and Germany. A domain-joined test VM had obtained it automatically for both the signed-in user and its provisioned package. These observations show availability in the checked markets and environment; they do not establish that every endpoint has updated.

Microsoft’s current CVE record identifies affected Paint versions from 11.0.0.0 up to, but excluding, 11.2609.401.0. It describes an out-of-bounds read permitting remote code execution and assigns a CVSS 3.1 score of 8.1. The record was published on October 13.

There is also a change since RFF’s update. Vitko reported that the public CVE still named an older version boundary, potentially confusing scanners. The Microsoft-authored record now carries the 11.2609.401.0 boundary, with an update timestamp of November 6 at 21:50:58 UTC. Reports about the earlier mismatch should be read in that chronology.

Inspect installed and provisioned packages separately

A useful check starts with installed packages across accounts. Microsoft’s Get-AppxPackage documentation explains that the command ordinarily works with a user profile; its AllUsers option lists packages for all accounts and requires administrator permissions. Restrict the results to Microsoft.Paint and examine the reported versions rather than relying on the administrator’s own profile. Run this read-only inventory command in an elevated PowerShell window:

Get-AppxPackage -AllUsers -Name Microsoft.Paint |
    Select-Object Name, Version, PackageUserInformation

The second check concerns future profiles. Microsoft’s Get-AppxProvisionedPackage documentation describes packages configured to install for each new user. Using its Online option targets the running operating system. Inspect the Microsoft.Paint entry there as a separate inventory item, alongside copies already installed for existing users:

Get-AppxProvisionedPackage -Online |
    Where-Object DisplayName -eq 'Microsoft.Paint' |
    Select-Object DisplayName, Version

Confirm delivery after the update

Vitko’s revised advice is to run the Store update scan or allow Store auto-updates, then verify that every relevant copy reaches 11.2609.401.0 or later. His earlier suggestion to remove Paint while waiting for availability is superseded by the update at the top of his report.

For fleet reporting, retain the endpoint, account or provisioning scope, observed version and inspection time. That makes an update result reviewable: an available package and a completed rollout are separate findings.