HackingPassion.comWindows Paint Had a Code Execution Hole and the Fix Microsoft Named Never Reached the Store
Ethical Hacking Complete Course Zero to Expert
Hack like black hat hackers. Penetration testing, Kali Linux, WiFi and web hacking, and the hacker mindset behind it.
→ Take the full courseOne crafted file opened in Paint could run an attacker’s code. In all 6 countries checked, the Store had no safe Paint. Auto-updates did not help. The fix Microsoft named on October 13 never got there.
On November 5, a Windows 11 PC with automatic app updates switched on in the Microsoft Store showed no update for Paint. Its owner assumed Paint was fine, and then looked up the version in the app’s settings.
Paint was running version 11.2603.251.0. According to Microsoft’s own documentation, only 11.2609.401.0 or newer was safe. The PC belonged to the editor of a Windows news site.
Microsoft tracks the hole as CVE-2026-83844. A program keeps the data it works with in blocks of memory, and each block has a fixed size. When Paint opens a picture, it reads what is in the file into such a block and works from there. Reading past the end of that block, into memory that was never meant for it, is called an out-of-bounds read. A file made for exactly that makes Paint do it, and according to Microsoft that can end with an attacker’s code running on your PC.
Microsoft’s own example of an attack is ordinary. Someone talks you into downloading a specially crafted file from a website, and you open it. Microsoft does not say which file type does it. The person who found the hole reported it anonymously.
Microsoft published the hole on October 13, the second Tuesday of the month, the day it releases its monthly security updates. On the same page it named the Paint version that fixed it: 11.2605.91.0.
That version never showed up in the Store or anywhere else.
On October 30, someone asked on Microsoft’s own question and answer forum where 11.2605.91.0 could be downloaded. The newest Paint they could get was 11.2605.81.0. 40 people clicked that they had the same question. The only answer came from another user, who did not think the version existed and guessed it was a typo.
Somewhere before November 4, Microsoft changed the number. In the security data Microsoft publishes for scanners and IT tools, the fixed version was now 11.2609.401.0. Microsoft added no note about the change to the page. And that version was not in the Store either.
The Store’s own product catalog shows why the update did not come. On November 5 at 03:34 UTC, Brian Vitko, who builds device management software at the company RFF, asked that catalog which Paint packages it had. He asked for six countries: the United States, the United Kingdom, Germany, Australia, India and Singapore. All six gave the same answer. The newest Paint was 11.2605.81.0. That is below the fix, so the Store had nothing better to install.
His two Windows 11 lab machines showed the same thing. Paint was on 11.2605.81.0 for each user, and as far as the Store was concerned, both machines were up to date. He then ran the update scan that company management tools use to push Store updates to their PCs, and watched Paint for four minutes. It stayed where it was.
The Windows 11 PC from the start of this post was further behind still. Its 11.2603.251.0 sat two releases below even the Store’s newest, while automatic updates were on.
Windows Update could not help here either. On a Windows PC, most fixes come through Windows Update, and Microsoft releases them on that second Tuesday of each month. The Paint app you open on Windows 11 comes from the Microsoft Store, in the same way as an app you install yourself, and only the Store updates it.
Microsoft’s own label for this fix says you have to do something yourself. Installing the October update for Windows 11 did not fix Paint. A PC that is fully up to date through Windows Update can still carry the old Paint.
On October 13, Microsoft gave the hole a score of 8.1 out of 10 and described it as an attack over the network, with no sign-in and no click from you. According to the first version of the page, an attacker could do it by sending a specially crafted packet to an affected service over the network.
That made little sense for a drawing program. Paint does not listen on the network. The developer who tested the Store said exactly that in an interview, and added that the sentence may simply have been Microsoft’s standard FAQ wording.
On November 7, Microsoft lowered the score to 7.0. The attack is now local, and you have to do something yourself: open the file. In the revision history, Microsoft called it an informational change only.
That score is a CVSS score, a number from 0 to 10 that says how bad a hole is. Behind the number sits a short code that describes the attack. In October the code said the attack came over the network and needed nothing from you. Now it says the attack is local, AV:L, and that you have to do something yourself, UI:R. The attack runs on your own PC, and only after you open the file.
Microsoft still calls it remote code execution. According to its new explanation, the word remote is about where the attacker sits, and that can be anywhere.
The first version is still out there. Articles written before November 7 describe an attack over the network, with no sign-in and no help from the user, and some headlines still call it a no-click bug. A story about this hole from last week may still describe the old version, the one Microsoft took back.
This is the second hole in Paint in two months.
On September 8, Microsoft published CVE-2026-70586, also in Paint. It rated that one Critical, with a score of 8.8. In that hole, Paint could write more data into a block of memory than fits, and the rest landed in the memory next to it. That is called a heap-based buffer overflow. Here too, the attack needs you to open a specially crafted file from the attacker.
This time the fix came inside Windows itself, through the normal monthly Windows update, for Windows 11, Windows Server 2012 up to 2025 and the Windows 10 versions that still get security updates. Windows 10 lost its normal support on October 14, 2025, so a home PC on Windows 10 only got this fix through Extended Security Updates.
Notepad went the same way, step by step. On February 10, Microsoft fixed a hole in it, CVE-2026-20841. The attack was a link inside a Markdown file. Clicking that link could make the app start other programs without checking them first, through so-called unverified protocols. Those could load and run files from your PC or from the internet. The fix was version 11.2512.26.0, and it came through the Store as well.
Reports at publication gave the hole a score of 8.8, as an attack over the network. Two days later, on February 12, Microsoft updated the score. Today it stands at 7.8, local, and the user has to open the file and click the link. On March 12, a month after the first fix, Microsoft wrote that it had released new updates to comprehensively address the hole. That is almost the same sentence it used for Paint on November 6.
Windows installs Store apps per user. Each account on a PC has its own copy of Paint: yours, your partner’s, the children’s, an extra admin account someone made once and then forgot. On top of that, Windows keeps a spare copy, called the provisioned copy, that it hands to each new account. A check of only your own account misses the others.
The spare copy counts too. When someone makes a new account on that PC, for a new colleague or for a child who gets a login of their own, Windows gives that account Paint from the spare copy. An old spare copy means the new account starts with the old Paint.
At work it can go one step further. A company can switch off the Store on its PCs with a policy called Turn off the Store application. One Microsoft page says app updates need the Store.
Another Microsoft page says Store apps keep updating on their own, and that PCs managed with Intune can still install them. Microsoft contradicts itself here, so on those PCs the IT department has to check whether Paint got the fix, with the same check further down in this post.
The fix arrived on November 6. At 04:14 UTC, the same catalog question returned 11.2609.401.0 for the United States, the United Kingdom and Germany. Microsoft added that version to its page the same day. The developer’s test machine had already picked it up on its own through Store auto-update, for the signed-in user and for the spare copy. That was 24 days after the hole was published.
A Microsoft spokesperson said that the update is available through the Store and that customers with automatic Store updates are already protected. Microsoft has not seen the hole used in attacks and thinks an attack is less likely. It says an attacker has to know the target PC very well, and even then the attack may fail.
CISA, the US cyber defense agency, gave its own view in the public record of the hole. It has not seen attacks either, and it rates the technical damage of a working attack as total.
The official records were late too. The public CVE record kept listing the version that never reached the Store until late on November 7. NVD, the US vulnerability database, still lists the hole as under analysis and has not yet added the version check that scanners look for. A scanner that only reads NVD has nothing to compare your Paint against.
What you can do on your own PC:
- โ Open Paint, go to Settings, and look at the version under About. 11.2609.401.0 or higher has the fix
- โ In the Microsoft Store, open Downloads and check for updates
- โ Keep automatic app updates on: in the Store, go to your profile, then Store settings, then App updates
- โ Check all copies of Paint on one PC in Windows PowerShell, opened as administrator:
| |
The first line lists each user’s copy of Paint, with the account it belongs to. The second line shows the spare copy for new accounts. Keep the -AllUsers in the first line. Without it, you only see your own copy. Anything below 11.2609.401.0 still has the hole.
- โ See which Paint the Store offers in your country. Change
market=USto your own country code, for example NL or DE:
| |
It prints the newest Paint the Store has for that country. 11.2609.401.0 or later means the fix is there, and a Store update will install it.
- โ At work, ask IT whether Paint reached 11.2609.401.0 on the PCs where the Store is switched off
Want to test how one version number decides if a Windows machine is vulnerable, on a virtual machine in your own lab? My Ethical Hacking Complete Course Zero to Expert takes you there step by step: reconnaissance, scanning, exploitation and traffic analysis, hands-on, from your first day with no Linux or hacking background.
โ Join my complete ethical hacking course
Hacking is not a hobby but a way of life.
Sources:
Microsoft Security Update Guide: CVE-2026-83844 | RFF: Windows Paint CVE-2026-83844 Store test | Microsoft Q&A: Paint 11.2605.91.0 | Microsoft Security Update Guide: CVE-2026-20841
Stay updated
Get the latest posts in your inbox every week. Ethical hacking, security news, tutorials, and everything that catches my attention. If that sounds useful, drop your email below.