Microsoft disclosed an out-of-bounds read in Paint on October 13, 2026, and says it could let an attacker run code on a PC over a network. It received a severity score of 8.1 out of 10, but Microsoft classified it as "Important," rather than "Critical."
Microsoft says an attacker does not need to authenticate: sending a specially crafted network packet to an affected service could be enough to exploit the flaw.
An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network.
Paint version 11.2609.401.0 and newer includes the fix, while earlier versions are considered vulnerable. Users can check their installed version in PowerShell with `Get-AppxPackage -Name Microsoft.Paint | Select-Object Name, Version`.
The fix is distributed through Microsoft Store, so installing the October 2026 Windows update alone does not guarantee Paint is patched. Windows Latest reported that its Paint installation remained on version 11.2603.251.0 despite automatic Store updates being enabled, and that no Paint update was available there.
Microsoft says the flaw is difficult to exploit, and Windows Latest reported no known cases of it being used in real-world attacks. If Microsoft Store does not offer the Paint update, how reliably can users count on the fix installing automatically?
