Microsoft fixed a serious flaw in Windows Paint, but Windows Update will not deliver the fix. It arrives only through the Microsoft Store.
Microsoft has fixed a serious security flaw in Paint, the drawing app that comes with Windows. The catch is how the fix arrives. Regular Windows updates will not install it. Paint has to be updated through the Microsoft Store, so a PC that looks fully up to date could still have the weak version.
The flaw is tracked as CVE-2026-83844. It is an out-of-bounds read, a bug where a program reads memory it should not touch. Microsoft says an attacker could use it to run code over a network. The company rates it Important, with a score of 8.1 out of 10. The fixed version is 11.2609.401.0, which was the newest Paint build in all ten countries The Hacker News checked.
Anyone who uses Paint on a Windows PC. Store apps are installed separately for each user account, and Windows can also keep a spare copy that it sets up for each new user. On a shared or business computer, checking only the account you are signed in to can miss older copies.
The version story is a little messy. Microsoft's advisory names 11.2609.401.0 as the fixed build. Last week it reportedly named 11.2605.91.0, and the revision history shows no note about the change. The official CVE record and the NVD entry still list Paint as affected only below 11.2605.91.0. A scanner that reads that record would treat 11.2605.91.0 as fixed. Version 11.2609.401.0 or newer passes either way.
The rollout also looks uneven. Brian Vitko of device-management software maker RFF found earlier this week that the Store offered only 11.2605.81.0, which lacks the fix, in six countries. His test virtual machine has since updated itself to the fixed build. That is one machine, and it is not clear how fast other PCs will get it.
Microsoft says the flaw was not known to be exploited or public when it was posted on October 13. It was not in the U.S. government's catalog of exploited flaws when The Hacker News checked. Microsoft also says a successful attack requires a deep understanding of the target system. Still, the advisory says no sign-in or user action is needed, so waiting is not wise.
The steps in the alert box above cover the Store update, the version check and shared PCs. Vitko's write-up also gives two commands that administrators can run to list every copy of Paint on a machine.
Microsoft does not name the network service an attacker would target. The advisory lists no workaround. Removing Paint where nobody needs it was suggested before the fix reached the Store, but it has not been tested.
Update Paint through the Microsoft Store and confirm it is at version 11.2609.401.0 or newer, because Windows Update will not do it.
The Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone callsScammers are posing as Texas sheriff's officers and claiming you missed jury duty. Caller ID can show a real police number even when the call is fake.
Read more: Fake jury duty calls spoof a real Texas sheriff's phone numberFake PayPal emails and texts, some posing as a security report, try to get you to tap a link and type your login. Checking your account directly avoids the trap.
Read more: Got a fake PayPal message? Skip its link and check your account yourself
