Paint got a code-execution fix, but you need the Microsoft Store

If you only trust Windows Update to keep built-in apps current, this one can slip past you. Microsoft’s fix for a Paint remote code execution bug is shipping through the Store instead.

You open an image a coworker sent, or one you grabbed from a shared folder, and expect Paint to be the safest app in the room.

That assumption is exactly where this kind of issue bites.

Microsoft has a fix out for CVE-2026-83844, a remote code execution flaw in Windows Paint. The catch is simple and easy to miss: Windows Update will not deliver this fix. Paint gets it through the Microsoft Store.

The fixed version is 11.2609.401.0. That was the newest Paint build showing in all ten countries checked today.

Why a Paint bug can turn into code execution

The bug is described as an out-of-bounds read. In plain English, that means the program can be tricked into looking at memory it was not supposed to touch.

Software usually treats a file like a recipe card. It expects the ingredients and steps to be in a certain order. If the file lies about that structure, a weak parser can start reading past the edges, like following a recipe that suddenly tells you to pull ingredients from a cupboard that is not there.

Sometimes that only crashes the app. Sometimes it opens the door to something worse.

In this case, Microsoft says the flaw could let an attacker run code over a network. That is the part that changes this from a weird bug into a real security problem. If a crafted image or related content reaches a vulnerable system in the right way, the attacker may be able to make your PC run their code instead of just opening a bad file.

The unusual part is how the fix arrives

A lot of people think “Windows is updated” means the apps that came with Windows are also updated.

That is no longer a safe assumption.

Some Microsoft apps now ride on separate update tracks. Paint is one of them here. So you can be fully current on Windows patches and still miss this fix if the Microsoft Store has not updated Paint yet, or if Store app updates are disabled.

That split matters because it creates a blind spot. Admins may confirm operating system patches are installed and assume the machine is covered. Home users may never open the Store at all.

If you are used to older Windows habits, think of this like changing the locks on your front door but forgetting the side door now has its own key and maintenance schedule.

What to check on your Windows PC right now

You do not need to guess.

• Open Paint.
• Check the app version.
• If it is not 11.2609.401.0, update Paint through the Microsoft Store.
• In the Store, check whether app updates are enabled so future fixes are less likely to sit idle.
• If you manage multiple PCs, verify Store-delivered apps are part of your normal patch routine, not just Windows Update.

If the Store does not show the update immediately, that may just mean rollout timing. But the version number is the useful truth test here.

There is also a basic safety habit worth repeating: be careful with image files from people or places you do not trust. That is not a complete defense, and nobody should rely on user caution instead of patching, but it does reduce easy opportunities while updates catch up.

The bigger lesson is about “built-in” software

Paint sounds harmless because it is familiar.

Familiar software still parses untrusted data, and parsers are where a lot of ugly bugs live. Image apps, document viewers, archive tools, media players — they all take structured input from outside your machine and try to make sense of it. That is enough to make them part of your attack surface.

The practical lesson is not “panic about Paint.” It is to stop treating bundled apps like they are somehow exempt from normal security hygiene.

If you use Windows, check Paint and make sure it is on version 11.2609.401.0. And more broadly, make sure Microsoft Store app updates are actually happening on your systems.

Windows Update is not the whole story anymore.