-
Paint on Windows 11 has a high-risk flaw, CVE-2026-83844, that could let attackers run code over a network.
-
The fix is Paint version 11.2609.401.0. Windows Update won’t install it, so you must update through the Microsoft Store.
-
Microsoft reports no attacks so far and says exploitation is less likely.
Microsoft Paint has shipped with Windows for decades. Now it has a serious security hole. Microsoft published the details on October 13, and the flaw scores 8.1 out of 10.
That puts it in the “High” range. Microsoft has released a fix. However, many PCs may still lack it, because Windows Update doesn’t deliver it.
MS Paint Flaw that lets attackers control your device remotely
The problem is an out-of-bounds read, meaning that Paint has a bug where it reads parts of your computer’s memory it’s not supposed to. Attackers can sometimes abuse that kind of error to run their own code.
Similar privilege-related risks have also affected Linux systems. In another reported case, the DirtyDecrypt Linux security bug let local attackers escalate privileges to root, potentially giving them extensive control over an affected system.
Microsoft says an attacker could do this over a network. The attacker needs no account and no password. The code would run with the same rights as the person using Paint.
Microsoft’s advisory says the attack needs no help from the user. It says an attacker would send a specially crafted packet to an affected service. However, the company doesn’t name that service. Some news sites have described a booby-trapped image file instead. Microsoft hasn’t confirmed that. So the exact attack path is still unclear.
Should users be worried?
There’s no serious cause for alarm, at least for now. Microsoft rates the attack complexity as high. In other words, a successful attack takes deep knowledge of the target system. Microsoft also rates exploitation as “less likely.” The flaw was neither public nor under attack when Microsoft released it.
Also, the U.S. Cybersecurity and Infrastructure Security Agency hasn’t added it to its list of exploited bugs. One tracking service puts the odds of an attack within 30 days at 0.65%.
Still, an 8.1 score deserves attention. Microsoft’s own scoring shows what a successful attack could do. An attacker could literally steal your data, modify your files and even shut the app down. Updating soon is the safer bet.
Why windows update won’t help
Paint is no longer part of the core Windows system. It’s a Microsoft Store app. Therefore, the fix arrives through the Store, not through Windows Update. A fully updated PC can still run a vulnerable copy of Paint.
Microsoft’s advisory names Paint 11.2609.401.0 as the fixed build. Anything older is at risk. The official CVE record, though, lists a different cutoff. It marks versions below 11.2605.91.0 as affected.
Until recently, Microsoft’s advisory gave that same number, according to a forum post. Microsoft hasn’t explained the change. Go with the higher number. A copy at 11.2609.401.0 or newer passes under both.
The fix didn’t reach everyone at once. Earlier this week, device-management researcher Brian Vitko checked the Store in six countries. He found only build 11.2605.81.0, which lacks the fix. A user on Microsoft’s support forum reported the same problem.
Things have since improved. On Friday, The Hacker News checked ten countries. In every one, 11.2609.401.0 was the newest build. Vitko’s test machine also updated itself. Even so, that’s a single machine. How fast other PCs will get the update is not yet clear.
One forum user claimed the fix first appeared only in South Asia. Microsoft hasn’t confirmed that. Phased rollouts are common, though. If the Store shows no update yet, try again in a day or two.
Signs of trouble for IT teams
Nobody has reported an attack. Still, security firm Threat Defence advises teams to watch for odd Paint behavior. Examples include Paint opening a command window, making strange network connections, saving program files, or crashing without cause. If a PC looks compromised, treat that user’s sign-in as exposed. Reset the password and end any active sessions.
Microsoft hasn’t named the affected service or explained how the attack works. It credits an anonymous researcher for reporting the bug. Meanwhile, the advisory’s revision history shows only its October 13 entry, with no note about the changed build number. So check Microsoft’s Security Update Guide for updates.
For most people, the next step is simple. Just open the Store, update Paint, and check the version. It only takes a few minutes.
Tips to protect yourself
- Open the Microsoft Store.
- Go to Downloads and check for updates.
- Install the Paint update if it appears.
- Make sure you’re running Paint version 11.2609.401.0 or newer.
Work computers need extra care. Paint installs separately for each user account. Windows may also keep a spare copy that it installs for each new account. As a result, checking only your own login can miss older copies. IT teams can list every copy with two PowerShell commands, which Vitko published in his test write-up.
Microsoft lists no workaround. Vitko suggested removing Paint from PCs where nobody needs it. He did not test that step, though.
