MS Paint RCE Flaw: Patch Confusion Leaves Windows 11 Exposed

MS Paint Vulnerability: A No-Click RCE Threat with a Patch Distribution Problem

Microsoft Paint, a staple of Windows for decades, is at the center of a newly disclosed remote code execution (RCE) vulnerability that has security teams scrambling. Tracked as CVE-2026-83844, the flaw carries a CVSS score of 8.1 (High) and allows unauthenticated attackers to execute code over a network. However, the real story is not just the bug itself, but the confusing and uneven rollout of the fix that leaves many systems exposed despite automatic updates being enabled.

Microsoft disclosed the vulnerability on October 13 and immediately released a patch via the Microsoft Store. Yet, multiple administrators and users report that the update is not appearing in their update queues, and even those with auto-update turned on are finding they still run vulnerable versions. This has led to a patch verification nightmare, with the company only recently clarifying the exact secure build number.

Technical Breakdown: Out-of-Bounds Read and No-Click Exploitation

The vulnerability is classified as a CWE-125 (out-of-bounds read), meaning the Paint application reads memory outside the intended buffer. In this case, a specially crafted image file can trigger this flaw, allowing an attacker to read sensitive memory contents and potentially execute arbitrary code. Microsoft’s advisory notes that the attack vector is over the network, requires no privileges, and no user interaction—a classic “no-click” scenario.

Despite the high severity, Microsoft rates the attack complexity as “High,” which typically implies that successful exploitation requires specific conditions or detailed system knowledge. This is why the company has not assigned a “Critical” rating, instead labeling it as “Important.” Nevertheless, security experts like those at Cybernews and Windows Latest warn that the lack of user interaction makes this a serious concern, especially for enterprise environments where Paint might be used to open images from untrusted sources.

The Patch Availability Problem: Why Auto-Updates Aren’t Enough

The core issue is that Microsoft distributes the Paint fix through the Microsoft Store, not via the regular Windows Update channel. This means that having a fully updated Windows 11 installation—including the October 2026 cumulative update that patched over 1,000 security issues—does not guarantee that Paint itself is patched. Users must specifically check the Paint app version in its settings.

Administrators have reported that the update is not showing up in the Microsoft Store, with some speculating about a phased rollout. One user on a tech forum claimed the patch was initially only available in South Asian regions, though this was not confirmed by Microsoft. The confusion was compounded by an initial error in the MSRC page that listed an incorrect version number. Microsoft has since updated the advisory to state that the secure version is 11.2609.401.0 or newer.

How to Verify Your Paint Version and Stay Protected

To check if your system is protected, open Microsoft Paint, click on the three-dot menu, select “About,” and look at the version number. If it is 11.2609.401.0 or higher, you are safe. If not, you should manually check for updates in the Microsoft Store by clicking on “Library” and then “Get updates.” If the update does not appear, some users have reported success by reinstalling Paint from the Store or using the “Get updates” button multiple times.

Microsoft has not provided a timeline for when the patch will be available globally, but it is crucial for administrators to not assume that automatic updates have applied the fix. Third-party enterprise antivirus solutions are already flagging Paint for missing the security patch, which may help in identifying unpatched systems.

Why This Matters: The Risk of No-Click RCE in a Default Windows App

Paint is a default Windows application, present on every Windows 11 installation. The fact that it can be exploited remotely without user interaction makes this a significant attack surface. While Microsoft downplays the risk due to the “High” attack complexity, the potential for an attacker to craft a malicious image that triggers code execution is real. In enterprise settings, where images are often shared via email or file shares, the risk is heightened.

This incident also highlights a broader issue: the increasing complexity of patch management when applications are distributed through separate channels like the Microsoft Store. Security teams must now track component versions beyond the OS build, adding another layer to their vulnerability management processes.

What to Do Right Now

• Check your Paint version immediately (Settings > About).
• If below 11.2609.401.0, manually trigger Microsoft Store updates.
• Monitor Microsoft’s security advisory for updated patch availability.
• Consider using third-party vulnerability scanners to detect unpatched Paint installations.
• Restrict access to Paint or use application whitelisting in high-security environments until the patch is confirmed.

As of now, there are no reports of active exploitation, but the patch gap is a ticking time bomb. Microsoft has not yet responded to requests for comment on the rollout timing. We will update this story as more information becomes available.