Microsoft Paint Flaw Fix Skips Windows Update: How to Get It

Microsoft has fixed a serious flaw in Paint, the drawing app that ships with Windows 11, but there is a catch that many office PCs will miss: the fix does not come through Windows Update. It is delivered only as a Microsoft Store app update, and for a time even the Store was handing out a build that did not contain it. This guide is for small business owners, IT staff and everyday Windows users who want to be sure every copy of Paint on their machines is actually patched.

Key takeaways

• The flaw is tracked as CVE-2026-83844 and rated Important by Microsoft, with a CVSS score of 8.1.
• The safe version is Paint 11.2609.401.0 or later. Older builds should be updated.
• Windows Update does not install this fix. Paint is updated through the Microsoft Store.
• Paint is installed per user, so a shared PC can have several copies at different versions.
• Microsoft says the bug was not known to be exploited when it was disclosed, so this is a patch-promptly issue, not a panic.

What Microsoft fixed

Microsoft published its advisory on 13 October 2026. It describes an out-of-bounds read in Paint, meaning the program can read memory beyond the area it set aside. According to Microsoft’s description, reported by The Hacker News, an attacker could trigger it by sending a specially crafted packet to an affected service over the network, without signing in and without the user doing anything. Microsoft also notes that a successful attack needs a deep understanding of the target system, which is one reason the attack complexity is rated high.

When the advisory was released, the flaw had not been publicly disclosed or seen in attacks. When The Hacker News checked on 6 November, it was not in CISA’s Known Exploited Vulnerabilities catalogue either.

Why the version number caused confusion

Microsoft’s Security Update Guide first listed Paint 11.2605.91.0 as the fixed build. German site Borncity, citing Neowin, reported that at the time the Store was offering only 11.2605.81.0, which did not include the fix. Microsoft has since updated its guidance and now lists 11.2609.401.0 as the fixed version. The public CVE record still mentions the older threshold, but a build at 11.2609.401.0 or higher satisfies both numbers, so that is the one to aim for.

Why Windows Update is not enough

Paint is updated as a Microsoft Store app rather than as part of Windows itself, so its fixes arrive the same way as updates to other Store apps. Businesses that rely only on Windows Update, or that have switched off the Store or its automatic updates, can end up with fully patched Windows and an unpatched Paint.

Brian Vitko, a researcher at device-management software maker RFF, found that in six countries he checked, the newest Store build was still the unfixed 11.2605.81.0. The Hacker News later found 11.2609.401.0 offered in all ten countries it checked, and one of its test machines updated on its own. How quickly every PC receives it remains unclear, which is why checking is worth a few minutes.

How to check your Paint version

On a single PC

1. Open PowerShell and run Get-AppxPackage Microsoft.Paint. The Version line shows the installed build.
2. If it is lower than 11.2609.401.0, open the Microsoft Store, go to your app library and check for updates, or let Store auto-update install it.
3. Run the command again and confirm the new version number.

On shared or office PCs

Because Paint is installed separately for each user account, checking only the signed-in account can miss older copies. Vitko recommends two PowerShell commands, run as administrator:

• Get-AppxPackage -AllUsers (filtered for Microsoft.Paint) lists the Paint version for every user account on the machine.
• Get-AppxProvisionedPackage -Online shows the copy Windows will install for any new user who signs in later.

After updating, run both commands again and confirm every entry shows 11.2609.401.0 or later. Organisations using Microsoft Intune or a similar management tool can trigger a Store app update scan across many PCs at once instead of visiting each desk.

Is there a workaround?

Microsoft’s advisory lists no workaround. Vitko suggested that where nobody needs Paint, removing it for every user, and removing the provisioned copy, would take the vulnerable app off the machine, though he noted he had not tested this approach. For most offices, simply updating is the cleaner option, since staff often use Paint to crop screenshots and annotate images.

A note for Nigerian and African SMEs

Many small offices run a mix of PCs bought at different times, some signed in with local accounts and some with the Store disabled to save data. That setup is exactly where Store-only fixes get missed. If your office restricts the Store to control bandwidth, schedule a time, perhaps outside business hours, to allow updates, then confirm the versions afterwards.

The bigger lesson: Store apps need patching too

The practical takeaway is that “Windows is up to date” does not mean every app on the PC is. A good monthly routine is to check Windows Update, then open the Microsoft Store library and install pending app updates, then update browsers and any line-of-business software.

What you should do

• Check Paint’s version on your own PC today and update it from the Microsoft Store if it is below 11.2609.401.0.
• On shared PCs, use the two PowerShell commands so no user account is left behind.
• Make sure Microsoft Store automatic app updates are allowed, or schedule a regular manual update window.
• If Paint is not needed on certain machines, such as kiosks or point-of-sale PCs, consider removing it after testing.
• Add “Store app updates” to your monthly patch checklist alongside Windows Update.

Sources

• The Hacker News: Microsoft Paint RCE fix now available, but Windows Update won’t deliver it
• Borncity: Microsoft Paint vulnerability, version 11.2609.401.0 protects

Featured image: Photo: “computer laptop keyboard HP Pavilion Entertainment PC” by GoodNCrazy, CC BY 2.0, via Openverse — source