Abstract:
Microsoft Paint, the built-in drawing tool of Windows 11, was recently discovered to have a serious security vulnerability. Under certain conditions, an attacker only needs to send specially constructed network data packets to the affected device, and the malicious code may be remotely executed without the user being aware of it or even needing to click on any files or links. What’s even more confusing is that although Microsoft has released a fix patch, some users still cannot get the corresponding update even if they turn on automatic updates in the Microsoft Store.
The number of this vulnerability is CVE-2026-83844. Microsoft officially disclosed it on October 13, 2026. The severity score is 8.1 points (out of 10 points) and is classified as "important" level. Although it has not yet reached Microsoft's highest level of "severe" rating, its potential impact cannot be ignored.
According to the security bulletin published by Microsoft, the vulnerability is an Out-of-bounds Read problem, that is, the program attempts to read data beyond the predetermined memory area. Under certain circumstances, an attacker could exploit this flaw to achieve remote code execution, running self-written code on an affected computer.
Microsoft's description of the attack method is that an unauthenticated attacker can send specially crafted data packets to the affected service through the network, triggering the vulnerability. This means that the attacker does not necessarily need to trick the user into opening a malicious file, nor does he have to wait for the user to actively perform an action, so it is called a "zero-click" vulnerability by the media.
However, Microsoft also pointed out that it is difficult to actually exploit this vulnerability. As of the time of the Windows Latest report, there have been no reports of this vulnerability being exploited in real-world attacks. Therefore, while users should confirm patch status as soon as possible, there is no need to panic.
What is really worrying is the abnormality in the patch distribution process.
When Microsoft disclosed the vulnerability on October 13, it had already pushed a repaired version through the Microsoft Store. According to Microsoft's own support documentation, the vulnerability fix cannot be completed until the Paint tool is upgraded to version 11.2609.401.0 or higher.
However, the Windows Latest editor checked the system with Microsoft Store automatic updates turned on and still found no available updates for the drawing tools. After further entering the drawing tool settings page to view the version information, it was found that the currently installed version was still 11.2603.251.0, which was significantly lower than the safe version specified by Microsoft.
This means that even if the user has turned on automatic application updates, it cannot be assumed that the painting tool has installed security patches.
Similar problems are not an isolated phenomenon. The report pointed out that other users also reported that they were unable to obtain drawing tool updates through the Microsoft Store that day. Some IT administrators even tried to use third-party tools to download the MSIX installation package of the application, but still could not find the fix version that Microsoft claimed.
It's not clear exactly what the problem is. One possibility is that the update distribution mechanism of the Microsoft Store fails, causing the repair version to not be displayed properly; another possibility is that the repair version number marked in the Microsoft security bulletin is incorrect, or even a version that has not actually been provided to users is recorded.
Microsoft has fixed more than 1,000 security issues in the Windows security updates released in October 2026, but installing these system updates does not mean that the drawing tool vulnerabilities will also be automatically fixed. The reason is that Paint is an application that is independently maintained and updated through the Microsoft Store, and its update mechanism is not exactly the same as the Windows operating system itself.
For users who want to confirm whether they are affected, they can check the actual version of Paint through Windows PowerShell.
Open PowerShell and execute the following command:
Get-AppxPackage -Name Microsoft.Paint | Select-Object Name, Version
If the displayed version number is 11.2609.401.0 or higher, according to Microsoft's security document, the device has already installed a repair patch. Installations lower than this are still considered vulnerable.
Even if the Microsoft Store currently only provides updates with version numbers lower than the security versions listed in Microsoft's announcement, users should still install the latest version of the drawing tool available. However, until Microsoft further clarifies the version number and update distribution issues, the system cannot be judged to be safe just because the App Store shows that there are no available updates.
This incident also once again exposed a real problem in the Windows application update system: keeping the operating system itself up to date does not mean that all built-in applications have completed security updates. For applications maintained independently through the Microsoft Store, users still need to pay attention to their own versions and patch status.
Although the drawing tool is only a basic application in Windows, it may still become an entry point for attackers to exploit. What is particularly noteworthy about this vulnerability is not only its remote code execution capability, but also the fact that Microsoft has announced a fix, but some users are unable to obtain the patch through normal update channels.
Comments