A Paint bug that hides in the picture

A crafted image file, opened in an app most Windows users have never thought twice about, is the premise of a vulnerability Microsoft has now fixed in Paint. The flaw is rated high severity, and the awkward part is distribution: because Paint ships as a standalone Microsoft Store app rather than a component of Windows, the corrective update travels through the Store, not Windows Update — and according to reporting, some users were still being served a vulnerable build.

The story is less about a dramatic exploit than about the plumbing. A fix exists, yet whether any given machine receives it depends on app update behavior that many organizations never audited.

What the flaw actually does

The vulnerability is tracked as CVE-2026-83844 and carries a severity score of 8.1/10, placing it in the high category. The National Vulnerability Database described it as an “out-of-bounds read in Windows Paint [that] allows an unauthorized attacker to execute code over a network.”

In practical terms, the source material lays out the mechanism this way: a threat actor could construct a special image that, when opened through Paint, triggers the flaw and runs malicious code on the affected system. The trigger is the act of opening a file, which is a low bar for any user who receives images routinely.

Microsoft has not published technical details explaining how such an attack would be carried out. According to the reporting, there are no confirmed cases of exploitation in the wild and no publicly available exploit code, so the scenario remains theoretical for now.

Why the bug stays theoretical, for now

Two factors determine whether a flaw like this moves from paper to practice: how potent it is, and how easy it is to leverage. The source reporting weighs both.

On potency, Microsoft classified the attack vector as “Network, with no privileges required” — meaning an attacker who already holds low-privilege access could use the bug to escalate privileges or deploy malware. The described downstream risks include credential theft, wire fraud, and ransomware.

On ease, Microsoft marked the bug's complexity as “High.” That suggests exploitation is not a simple undertaking, which the reporting notes could limit abuse to state-sponsored actors or well-resourced for-profit hacking groups.

The CISA Known Exploited Vulnerabilities (KEV) catalog does not list this bug, which the source treats as an indication that there are no confirmed attacks, particularly against government entities.

The update that didn't arrive

Microsoft moved Paint out of Windows and into a standalone Microsoft Store app. The consequence is administrative: the security fix is not distributed through the regular Windows Update mechanism, and users must update Paint through the Microsoft Store themselves unless automatic app updates are switched on.

The company apparently included a fix in Paint version 11.2605.91.0. But Neowin reported that despite releasing the newer build, Microsoft was still offering a vulnerable one — 11.2605.81.0 — on its app Store. The discrepancy was visible enough that multiple people opened a discussion on Reddit, and one user shared PowerShell output showing Paint remained on a vulnerable version even after checking for updates through the Store.

At the time of the original reporting, a check of the Microsoft Store showed version 11.2609.401.0 being offered, with November 5 as the date of the newest update. Neowin also reported that for some Reddit users, that was the version carrying the fix. The reporting raises the possibility that Microsoft opted for a staggered release rather than a global rollout, which would explain why some people were late to be offered the patch.

Checking the version yourself

Simply opening the Microsoft Store may not be enough to confirm a system is secure, according to the source. Users are advised to double-check their Paint version using PowerShell with the command: Get-AppxPackage Microsoft.Paint | Select-Object Name, Version.

Those who still see the older version should keep watching the Microsoft Store for the patch and follow Microsoft's Security Update Guide for the vulnerability. For anyone concerned about being targeted, the source suggests temporary restrictions on certain image attachments, or removing Paint from the system entirely.

How AI in Paint changes the calculus

The reporting notes that Microsoft added AI into Paint, which makes the idea of malicious packages being triggered through the app considerably more viable. That observation is offered as context for why an image-editing utility warrants attention at all.

It also sits alongside the absence of published technical detail. Without a public write-up of the exploit path, defenders cannot test the flaw themselves, and the theoretical status of the bug rests largely on Microsoft's silence and the empty KEV entry.

The gap between fixed and patched

There is a distinction worth holding onto here: a vendor shipping a fix is not the same as users running it. The Store distribution model introduces a dependency on user behavior — checking for updates, or having automatic updates enabled — that the older Windows Update pipeline did not require in the same way.

The Reddit reports describe exactly that failure mode. A user who believes they are current, because they checked, may still be on a build Microsoft itself acknowledged as vulnerable. Version numbers become the only reliable evidence.

• CVE-2026-83844 — the identifier assigned to the Paint out-of-bounds read flaw
• 8.1/10 — the severity score, placing it in the high category
• 11.2605.91.0 — the Paint version reported to contain the fix
• 11.2605.81.0 — the vulnerable version reportedly still offered on the Store
• 11.2609.401.0 — the version observed at the time of reporting, dated November 5

What this means for defenders

The practical takeaway is that application-level patching deserves the same scrutiny as operating system patching, particularly for apps that have been decoupled from Windows Update. A fix that depends on each user visiting a storefront is a fix whose reach is uneven by design — and the reporting here suggests the unevenness was real, not hypothetical.

For organizations, this could mean auditing which Store-delivered apps are installed, whether automatic updates are enabled, and whether version checks are part of routine maintenance rather than an afterthought. The PowerShell command above is a starting point, not a complete inventory.

The broader inference is uncomfortable but reasonable: as more formerly built-in Windows components migrate to standalone distribution, the update path for security fixes fragments with them. This particular bug may never be exploited. The distribution question it surfaced will outlast it.