Microsoft has released a security update for a serious flaw in its Paint application, but the remedy is not reaching everyone smoothly. The Microsoft Paint vulnerability fix, tracked as CVE-2026-83844, carries a high severity rating of 8.1 out of 10 and could let an attacker run malicious code after a specially crafted is opened in the app.
What the flaw allows
The National Vulnerability Database describes the issue as an out-of-bounds read in Windows Paint that permits an unauthenticated attacker to execute code over a network. In practical terms, a booby-trapped file could trigger the bug and allow code to run on an affected machine.
Microsoft has not published technical details that would explain how such an attack could be carried out. There are also no confirmed cases of exploitation in the wild and no publicly available exploit code. The vulnerability does not appear in CISA’s Known Exploited Vulnerabilities catalog, which lists bugs with confirmed attacks, particularly against government systems.
Whether the flaw remains purely theoretical depends on two factors: how powerful the bug is and how easy it is to exploit. Microsoft classified the attack vector as network-based with no privileges required, meaning an attacker who already holds low-level access could use it to escalate privileges or deploy malware. That could open the door to credential theft, wire fraud, or ransomware. However, Microsoft rated the complexity as high, suggesting exploitation is not simple. That could restrict abuse to state-sponsored groups or well-funded criminal operations.
Why the update isn't automatic for everyone
Paint is no longer a built-in Windows component; it is a standalone app distributed through the Microsoft Store. As a result, the fix does not arrive through the usual Windows Update channel. Users must update Paint through the Store themselves unless they have enabled automatic app updates.
Microsoft included the fix in Paint version 11.2605.91.0, according to reports. Yet some users found that the Store was still offering an older, vulnerable build, 11.2605.81.0. The discrepancy was noticed by multiple people, including Reddit users who discussed the issue. One user shared PowerShell output showing that Paint remained on a vulnerable version even after checking for updates through the Store.
At the time of writing, the Microsoft Store was offering Paint version 11.2609.401.0, with the newest update dated November 5. Some Reddit users cited by Neowin said this was the version that carried the fix for them. The uneven rollout suggests Microsoft may have opted for a staggered release rather than a global one, which would explain why some people were not immediately offered the patch.
How to confirm your Paint version
Simply opening the Microsoft Store may not be enough to confirm that your system is protected. Users should verify the installed Paint version directly. One way is to run a PowerShell command that lists the app package name and version, such as: Get-AppxPackage Microsoft.Paint | Select-Object Name, Version.
If the output shows an older version, users should keep checking the Microsoft Store for the update and monitor Microsoft’s Security Update Guide for the vulnerability. Those who are especially concerned about exposure could temporarily restrict certain attachments or remove Paint from their systems altogether.
