Microsoft Paint Security Flaw Could Let Hackers Execute Malicious Code, but the Fix Is Hard to Find

Microsoft Paint has a high-severity remote code execution vulnerability, but some Windows 11 users and IT administrators cannot find the update that fixes it.

The vulnerability, tracked as CVE-2026-83844, carries a CVSS score of 8.1 and could allow attackers to execute malicious code through specially crafted image files.

Microsoft Paint vulnerability could allow remote code execution

According to Microsoft’s Security Response Center, the vulnerability involves an out-of-bounds read in Microsoft Paint that could potentially allow an attacker to execute malicious code.

Microsoft classifies the flaw as high severity, with a CVSS score of 8.1. It has a network attack vector, requires no privileges, and carries high attack complexity.

Microsoft Paint’s patched version is reportedly missing from the Store

Microsoft initially identified Paint version 11.2605.91.0 as the release addressing CVE-2026-83844. However, administrators reported that the Microsoft Store continued distributing the older 11.2605.81.0 version.

Users on Microsoft Q&A and Reddit reported that they could not obtain the patched version, even after manually checking for updates.

Adding to the confusion, Microsoft’s Security Update Guide now reportedly identifies version 11.2609.401.0 as the fix, raising questions about whether the original version number was incorrect.

The conflicting information has made it difficult for administrators to determine whether their systems have received the necessary security update.

How to check if Microsoft Paint has the security fix

Users and administrators should verify their installed Paint version rather than relying entirely on the Microsoft Store’s update status.

To check the installed version, open PowerShell and run the following command:

Get-AppxPackage Microsoft.Paint | Select-Object Name, Version

Compare the result with the version listed in Microsoft’s official security advisory.

If the installed version remains outdated, check the Microsoft Store for updates. Organizations that cannot obtain the fix can also consider temporarily restricting untrusted image files or removing Paint from systems that do not require it.

The issue follows another Microsoft update problem, as the company recently had to fix an Excel copy-and-paste bug again after an October update reintroduced the issue.

Meanwhile, Microsoft has also focused on improving Windows 11 performance. The company claims Windows 11 runs faster on PCs with 8GB of RAM, while recent tests suggest that Windows 11 26H2 uses up to 1.2GB less RAM.

Via Neowin