Paint RCE Patch at 11.2609.401.0 Ships Only via Store, Bypassing Windows Update
Microsoft Paint RCE fix reached the Store at a higher build than listed in the CVE record, creating scanner blind spots. Per-user and provisioned installs require explicit enumeration beyond standard Windows Update. The pattern shows Store apps continue to diverge from centralized patch channels without documented enterprise controls.
The vulnerability is an out-of-bounds read in Microsoft Paint rated Important with CVSS 8.1. Exploitation requires sending a crafted packet over the network with no authentication or user interaction needed. Microsoft stated the flaw was not publicly known or exploited at disclosure. Brian Vitko's checks across multiple countries showed the fixed build reached some test systems only through background Store auto-update.
Advisory revision history shows no update when the fixed build number changed from 11.2605.91.0 to 11.2609.401.0. Scanners pulling from NVD or CVE JSON will therefore classify builds between those two numbers as patched when they are not. Paint installs per user plus a provisioned package, so single-account checks miss older copies that remain vulnerable.
Store apps follow separate delivery paths from core Windows components, creating persistent gaps in enterprise environments using WSUS or Intune without explicit Store scan policies. Removal of Paint via Get-AppxPackage and Get-AppxProvisionedPackage commands was suggested pre-patch but never validated at scale. No mitigation exists beyond the Store update.
CISA KEV listing remains absent. Next step is confirmation whether the advisory will be revised again or if device-management tooling will surface the version mismatch in dashboards within 30 days.
Sources (2)
- [1]The Hacker News(https://thehackernews.com/2026/11/microsoft-paint-rce-fix-now-available.html)
- [2]Microsoft Security Response Center(https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83844)