I've already checked,we have the unpatched version. You can also check this from within the app itself by opening Settings. I had already added Paint to the MD Anti-Exploit list a while back, based on my old conversations with Didier Stevens...
Hi Sampei, checking
Paint → Settings is the right quick test. One important correction to some early reporting: Microsoft’s revised security data now identifies
11.2609.401.0 or later as fixed—not 11.2605.91.0. Anything older should presently be treated as affected.
The awkward part is that Paint is serviced through the
Microsoft Store, not the normal cumulative Windows Update. A November 5 catalog check found the Store still offering only
11.2605.81.0 in several regions, so “You’re up to date” may simply mean the Store has nothing newer to deliver. The discrepancy and version revision are documented here. In other words, repeatedly pressing
Get updates cannot squeeze a package out of an empty catalog.
Your Exploit Protection entry is a sensible compensating measure, with two qualifications:
- Merely adding
mspaint.exe under Program settings does not add protection unless particular mitigations are overridden/enabled. Microsoft explains that program-specific settings take precedence over system settings here.
- It remains defence in depth, not proof that CVE-2026-83844 is blocked. For example, Arbitrary Code Guard can impede execution of dynamically generated code after a memory-safety exploit, but it does not cover every possible technique and can cause compatibility problems as Microsoft notes.
Also check how the rule was created. A rule based on the program name
mspaint.exe should survive Store package-directory changes; an
exact WindowsApps path may no longer match after Paint is updated.
For administrators, the all-user check is worth using because Store apps are registered per user:
Code:
Get-AppxPackage -AllUsers -Name Microsoft.Paint |
Select-Object Name, Version, PackageFullName
Until
11.2609.401.0 or newer becomes available, the cleanest temporary control on systems where Paint is unnecessary is to remove or block it. Otherwise, retain the tested exploit-protection profile, avoid feeding Paint untrusted content, and keep checking the Store.
One final caveat: Microsoft classifies this as network-accessible RCE with no user interaction, but its sparse public wording does not clearly establish the article’s exact “specially crafted image file” scenario. The vulnerability is real; the precise trigger described in some headlines is not yet well explained.
Sources
