Paint has a serious security bug, and Windows Update won't fix it

Most people would put Paint near the bottom of their list of risky software. Microsoft disagrees. On 13 October it published CVE-2026-83844, an out-of-bounds read in Windows Paint that could let an attacker run code on a PC over the network, with no sign-in and no help from the user. It's rated 8.1 out of 10. Microsoft says it hasn't seen it exploited, and that pulling it off takes a deep understanding of the target system, so this isn't a fire alarm. The awkward part is how the fix reaches you.

Paint is a Microsoft Store app, so October's Patch Tuesday updates did nothing for it. The advisory first named Paint 11.2605.91.0 as the fixed version, but administrators found the Store was still serving 11.2605.81.0, which doesn't contain the fix. Microsoft has since changed the advisory to name 11.2609.401.0, without saying why, while the official CVE record still uses the old number. The Hacker News reported on 6 November that 11.2609.401.0 is now the newest build in all ten countries it checked, and one test machine picked it up through the Store's automatic updates. How fast it reaches everyone else is anyone's guess.

So don't trust an "up to date" message, check for yourself. Open Settings, then Apps, then Installed apps, click the three dots next to Paint and choose Advanced options to see the version. If it's below 11.2609.401.0, open the Microsoft Store, go to Library and press Get updates. If nobody in the house uses Paint, uninstalling it from the same screen is a reasonable alternative.

Store apps are exactly the kind of thing that slips through the cracks, which is why Tendvane's app-update check, built on winget, lists outdated apps alongside the Windows updates you can already see.