O que aconteceu
Microsoft released a security update for Paint (build 11.2609.401.0) that resolves CVE‑2026‑83844, an out‑of‑bounds read that could allow an attacker to execute code over the network. Unlike most Windows components, the Paint update is distributed exclusively via the Microsoft Store and does not appear in Windows Update. The fixed build is now available in all ten countries examined by The Hacker News. No public exploits have been reported, but the vulnerability’s remote nature warrants a high severity rating.
Por que isso importa para confiança e conformidade
- The situation highlights the need for a robust Patch Management control that tracks all software distribution channels, ensuring timely remediation and defensible audit evidence.
- Demonstrates the importance of continuous monitoring of all update mechanisms, not just Windows Update.
- Provides evidence‑ready data for auditors by mapping Store‑based patches to the Patch Management control objective.
Who is affected
TECH_SAAS
Recommended actions
- Inventory Paint versions across all Windows endpoints.
- Deploy the Microsoft Store update to any device running a pre‑fixed version.
- Update patch‑management policies to require verification of Store‑delivered patches.
- Document patch deployment evidence for compliance audits.
Detalhes
- CVEs
- CVE-2026-83844