A newly disclosed vulnerability in Microsoft Paint — the basic drawing app built into Windows 11 — can let an attacker run malicious code on your PC over the network without you clicking anything. Microsoft has released a patch, but many Windows 11 users report they can't actually find the fixed version in the Microsoft Store, leaving everyday home and small-business PCs exposed longer than they should be.
What the Paint bug actually does
A zero-click vulnerability in Windows Paint (CVE-2026-83844) enables remote code execution without user interaction, and was disclosed in the drawing tool integrated in Microsoft Windows 11. The flaw carries a CVSS score of 8.1, placing it in the High severity category rather than Critical.
Technically, the vulnerability stems from an out-of-bounds read, a memory error in which software reads beyond its intended boundary. In plain English: an unauthenticated attacker can send specially crafted data packets to the targeted service over the network, triggering the vulnerability, which means the attacker does not need to persuade the user to open malicious files or wait for the user to perform a specific action — which is why the media have labeled it a "zero‑click" vulnerability.
A crafted image could trigger the flaw, but Microsoft's quoted guidance describes a crafted network packet sent to an affected service. The Hacker News discussion highlights the missing detail: neither the exposed service nor the complete attack path is identified. Suggestions involving Copilot or other components are speculation. In other words, Microsoft hasn't spelled out exactly how the attack works, which is unusual for a flaw this serious.
The patch exists — but good luck finding it
This is where it gets messy for regular Windows users. Microsoft Paint has a high-severity remote code execution vulnerability, but some Windows 11 users and IT administrators cannot find the update that fixes it.
Microsoft initially listed Paint version 11.2605.91.0 as the fixed release, but administrators reported that Microsoft Store continued offering 11.2605.81.0, even after update checks and Store cache resets. Adding to the confusion, Microsoft's Security Update Guide now reportedly identifies version 11.2609.401.0 as the fix, raising questions about whether the original version number was incorrect.
The practical takeaway: the company is adamant that it is best to verify the new Paint version specifically, rather than assume a general Windows update fixes the problem. If you've ever had our team clean up a malware infection after a drive-by download, this is the same class of risk — except here no click is required.
How to check your Paint version
On your Windows 11 PC, open Paint, click the Settings gear (or the "..." menu depending on build), and look at the "About" information for the version number. Users should verify Paint build 11.2609.401.0 instead of assuming Windows Update fixed it.
If the Microsoft Store won't offer the updated build, open the Store app, go to Library, and force an "Update all." If Paint still won't move to the current version, you're not alone — it's a known staggered-rollout problem, and for now there's no clean workaround beyond waiting or removing Paint on machines that don't need it.
If your PC is already behaving oddly — slow boots, unexplained pop-ups, programs launching on their own — don't assume it's just age. Those are classic signs of compromise, and bringing the machine into a local repair shop for a hands-on diagnostic is faster than troubleshooting blind.
Why a bug in a 'basic' app matters
The drawing tool, although merely a basic Windows application, can still become an entry point for attackers. That's the broader lesson here: pre-installed Windows apps that most people never think about — Paint, Notepad, Media Player — are still code running on your machine, and still need patching.
This also lands in a month where Microsoft is already under pressure on security volume. Microsoft's wider October 2026 security release addressed 1,413 CVEs across its product portfolio, according to its October Security Update Guide, and Jeremy Chapman, a director at Microsoft 365 who works closely with Windows customers on security, strongly warned against delaying Windows updates. The next scheduled round of fixes lands November 10.
What This Means for York, PA
For York-area home users and small businesses running Windows 11, the action item is simple: open Paint today, confirm the build number, and force a Microsoft Store update if you're behind. If you'd rather have someone verify your whole system is patched and clean, walk into York Computer Repair at 2069 Carlisle Rd during business hours — no appointment needed.
Sources
- Microsoft Paint flaw allows remote code execution (Cybernews)
- Microsoft Paint Security Flaw Could Let Hackers Execute Malicious Code, but the Fix Is Hard to Find (Windows Report)
- Zero‑Click Bug in Windows Paint Lets Hackers Access Your PC (Red Hot Cyber)
- Microsoft Paint CVE-2026-83844 lets hackers hack Windows 11 PCs over internet (Neowin)
- Microsoft Paint 0-Click Vulnerability Could Allow Hackers to Take Control of Windows PCs (Cybersecurity News)