Microsoft Paint Patch for CVE-2026-83844 Fails to Reach Some Windows 11 Users via Microsoft Store
Microsoft has addressed a remote code execution vulnerability in the Paint application bundled with Windows 11, yet the fix is failing to reach a portion of users through the Microsoft Store.
The flaw, identified as CVE-2026-83844, received a CVSS score of 8.1 and was rated important. It stems from an out-of-bounds memory read that could theoretically permit unauthenticated network-based attacks without any user interaction, although Microsoft assesses exploitation difficulty as high.
Unlike standard Windows security updates, the Paint patch is distributed exclusively via the Microsoft Store and is not included in cumulative Windows Update packages. This separation means that installing the latest Windows cumulative updates does not guarantee protection for the image editor.
The officially clean build is listed as version 11.2609.401.0. However, Windows Latest confirmed that its test system remained on the older 11.2603.251.0 build even with automatic updates enabled. Additional administrators have reported that manually checking for updates inside the Microsoft Store also fails to deliver the patch.
The root cause of the distribution discrepancy remains unclear and may involve either rollout problems or an incorrect version number in Microsoft’s documentation. No evidence of active exploitation of CVE-2026-83844 in real-world attacks has been reported.
Users are advised to open Paint settings and confirm that the latest available version from the Microsoft Store is installed.
Related articles
Citrix Issues Critical XenServer Patches for Host Compromise Vulnerabilities
Citrix published security bulletin CTX697256 on November 3, 2026, disclosing eight vulnerabilities affecting XenServer. The most severe issue, tracked as CVE-2026-98432 and rated critical, enables an unauthenticated attacker who reaches the management network to compromise the virtualization host and associated appliances. A second flaw, CVE-2026-102703, allows a privileged user inside a guest virtual machine to break out and take control of the underlying host, violating isolation guarantees. Six additional vulnerabilities impact network boot and secure boot processes, potentially allowing attackers to compromise VMs during startup or bypass code-signing policies. Affected products include XenServer 8.4 and 9 along with Workload Balancing and Conversion Manager appliances. Citrix recommends immediate application of the fixes and temporary isolation of the management network while updates are deployed.
Mozilla Releases Firefox 159.0.1 to Patch High-Severity Layout Vulnerability CVE-2026-120572
Mozilla Foundation has issued Firefox 159.0.1 to address a high-severity vulnerability tracked as CVE-2026-120572. The flaw resides in the Layout: Block and Inline component responsible for web page rendering. It stems from improper handling of boundary conditions during layout processing. CISA assigned the issue a CVSSv3.1 base score of 8.8, confirming high impact. The update was published on November 3, 2026, and is rated high severity by both Mozilla and CISA. Users are advised to apply the patch immediately to mitigate potential exploitation risks.
WatchGuard AuthPoint Authentication Gateway Hit by Four Critical Vulnerabilities
WatchGuard disclosed four security advisories for its AuthPoint multi-factor authentication solution on November 4, 2026. Three of the issues received a Critical rating while one was rated High. The flaws reside in the AuthPoint Authentication Gateway component and affect environments integrated with LDAP and Active Directory. CVE-2026-121639 allows unauthenticated attackers to disrupt authentication services or delete directory synchronization settings over the network. The remaining three vulnerabilities enable man-in-the-middle attacks, capture-replay actions, and forged authentication results. No exploitation in the wild has been observed. WatchGuard has released updated versions to address all reported issues.
sshhole: OpenSSH Authentication Bypass on musl libc Systems Without PAM
An emergency patch for OpenSSH 10.6p2 was released on November 5, 2026, to fix a critical authentication bypass vulnerability affecting Linux systems using musl libc without PAM support. The flaw allowed attackers to log into accounts with a locked password by supplying any string longer than 256 bytes. The root cause traces back to a chain of engineering decisions: musl's crypt() returning '*' on length errors instead of NULL, OpenSSH's 2016 timing attack mitigation that selected salts from real hashes, and the resulting strcmp match between error result and the shadow '*' marker. Exploitation required a specific combination of musl, OpenSSH without PAM, password authentication enabled, and an account marked with '*' in /etc/shadow, notably impacting Alpine Linux cloud images. The vulnerability was discovered by researcher Özgün Kültekin using LLM-assisted fuzzing of 17,600 authentication variants. OpenSSH 10.6p2 or equivalent distribution patches close the issue; until applied, administrators should set PasswordAuthentication no where password login is unnecessary.