Microsoft Patches High-Severity Paint Flaw as Store Rollout Causes Patch Delay
Because Paint updates through the Microsoft Store rather than Windows Update, a staggered rollout has temporarily left some systems on vulnerable builds.
Microsoft has released a security update to address a high-severity vulnerability in Paint that could enable attackers to execute arbitrary code remotely through specially crafted image files.
Tracked as CVE-2026-83844 with a CVSS score of 8.1 out of 10, the flaw stems from an out-of-bounds read condition described by the National Vulnerability Database as allowing an unauthorized attacker to execute code over a network. According to a report by TechRadar Pro (https://www.techradar.com/pro/security/even-microsoft-paint-is-being-targeted-by-cyberattackers-update-now-or-face-the-consequences), an attacker could theoretically trigger the bug if a victim opens a malicious image file in the application.
Microsoft classified the attack vector as network-accessible with no privileges required, creating potential avenues for privilege escalation or secondary malware deployment. However, Microsoft designated the attack complexity as high. Neither Microsoft nor the Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog has recorded active in-the-wild exploitation, and no public exploit code has surfaced.
The distribution of the fix highlights an operational hurdle stemming from Microsoft's decision to decouple Paint from standard Windows Update cycles and host it as a standalone Microsoft Store application. Because patches depend on Store delivery channels, users without automated app updates must fetch the new release manually.
Remediation has also encountered rollout friction. While Microsoft bundled the fix into version 11.2605.91.0, user reports surfaced on Reddit and Neowin indicating the Store continued serving the vulnerable 11.2605.81.0 build in certain instances. At press time, TechRadar Pro observed the Store serving an updated build, version 11.2609.401.0, suggesting a phased geographic or platform deployment.
Administrators and individual users can verify their installed build using the PowerShell command `Get-AppxPackage Microsoft.Paint | Select-Object Name, Version`. Security advisories recommend monitoring the Microsoft Store for pending updates or restricting untrusted image files until the patched version appears.
Sources
Written by
The Company Wire
Inside the companies building what’s next. Reporting on startups, technology, funding and the people shaping them.
