Microsoft Paint contains a remote code execution vulnerability with a CVSS score of 8.1. Microsoft released a fix in October, but many administrators are unable to obtain the patched version. There is also confusion regarding the correct version number.
A vulnerability in Microsoft Paint allows attackers to remotely execute code on Windows 11 PCs. This vulnerability is known as CVE-2026-83844. Microsoft publicly disclosed its existence on October 13 and released a fix. However, administrators report that the update is not reaching them.
The vulnerability involves an out-of-bounds read in Paint. Using a specially crafted image, an attacker can execute malicious code. According to Microsoft’s own classification, the attack occurs over the network and does not require any privileges. Nevertheless, the company rates the attack complexity as “High.” Windows Latest, however, describes it as a no-click bug that can remain unpatched even with automatic updates enabled.
Which version is secure?
In the Security Update Guide, Microsoft initially listed version 11.2605.91.0 as the patched, and therefore secure, release. On a Microsoft Q&A forum, someone asked where that version could be found, since the Microsoft Store was still offering the insecure version 11.2605.81.0. On Reddit, a moderator shared PowerShell output showing that Paint remained stuck on that older version, even after checking for updates in the Store and running WSReset.
This may be a phased rollout, somewhat unusual for a dangerous vulnerability but common for a patch. One user claims that the patch is currently only available in South Asian regions. However, the MSRC page now lists version 11.2609.401.0 as the fix. It appears the earlier version contained a typo, though Microsoft has not confirmed this. Other sources also identify 11.2609.401.0 as the secure version.
Check for yourself
So the fact that the Store marks Paint as up-to-date doesn’t mean much. You can check the version actually installed using PowerShell: Get-AppxPackage Microsoft.Paint | Select-Object Name, Version. As long as the patch isn’t available everywhere, organizations can temporarily restrict unreliable image attachments. And anyone who doesn’t need Paint for whatever reason can also uninstall the app.
See also: Vulnerability in Windows Defender leads to file loss