Microsoft published details of a Windows 11 Paint vulnerability on October 13 that allows remote code execution through a manipulated image. Microsoft says it fixed the flaw, but users and enterprise administrators report difficulty downloading the updated app from the Microsoft Store.
Key takeaways
CVE-2026-83844 carries a CVSS score of 8.1 out of 10.
Exploitation requires a user to open a manipulated image in Paint.
Users report update failures despite manual checks and Store cache resets.
How the Windows 11 Paint vulnerability works
The flaw, identified as CVE-2026-83844 by the Microsoft Security Response Center , is an out-of-bounds read . It allows Paint to access memory beyond its defined boundaries, with remote code execution possible through a specially altered image.
An attacker would need to persuade someone to download the manipulated image and open it in Paint, the photo editor preinstalled on Windows 11. The attack is not automatic: user interaction is required .
The vulnerability has a CVSS severity score of 8.1 out of 10 . Attack complexity is classified as high, making immediate exploitation relatively unlikely despite the potential severity.
Microsoft’s fix meets Store download problems
Microsoft says it corrected the issue and distributed an updated Paint package. Users and administrators, however, report that they have been unable to obtain the update through the Microsoft Store.
In the details published on October 13, Microsoft initially identified Paint 11.2605.91.0 as the fixed release. Administrators reported that the Store continued supplying version 11.2605.81.0 , despite the security documentation pointing to a later version.
Some users reported unsuccessful downloads even after manually checking for updates. Others tried WSReset, Microsoft’s tool for resetting the Store cache, without obtaining the updated app.
Checks and precautions for administrators and users
The recommendations for addressing the Windows 11 Paint vulnerability include checking the installed app version directly with PowerShell rather than relying on the version shown by the Microsoft Store.
Administrators can retrieve the installed package name and version with this command: Get-AppxPackage Microsoft.Paint | Select-Object Name, Version .
The recommended enterprise precautions also include preventing Paint from opening images from external sources. Where the application is unnecessary, administrators can disable Paint entirely.
For private users, the recommended precaution is to avoid opening images downloaded from the internet in Paint.
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.
