Microsoft Patches Critical Paint Vulnerability via Microsoft Store — Here's How to Verify Your Update

Microsoft has addressed a significant security vulnerability in Paint, the built-in drawing application for Windows 11, by releasing a new version of the app through the Microsoft Store. Unlike typical Windows updates, this fix does not arrive automatically via Windows Update and requires users to check manually that their system is up to date.

The short version

Microsoft updated its security advisory on November 6 to confirm that the complete fix is Paint version 11.2609.401.0. Here is how to determine whether your installation is current and what to do if it is not.

1. The flaw is tracked as CVE-2026-83844 and Microsoft rates it as Important, with a severity score of 7.0 out of 10. Microsoft lowered the severity score on November 7 after adding more detail to the advisory.
2. Microsoft states that the vulnerability had not been publicly disclosed or actively exploited in attacks, and rates exploitation as less likely.
3. The fix is Paint version 11.2609.401.0, which arrives as a Microsoft Store app update rather than through Windows Update.
4. To verify your version, open Paint, select Settings, and look for the version number under About Paint.
5. If you are behind, open the Microsoft Store, go to Library, and select Get updates to install the latest version.

What Microsoft fixed in Paint

According to Microsoft's official security notice, the bug is an "out-of-bounds read" that could allow the application to access memory outside its intended boundaries. If successfully exploited, an attacker could execute arbitrary code on the affected computer. Microsoft clarified on November 7 that the attack occurs locally on the machine and requires the user to perform an action, such as being tricked into downloading and opening a specially crafted file.

That may sound concerning, so here is the context Microsoft provides in the same advisory:

• The attack is rated high complexity, requiring "a deep understanding of the system" and is not guaranteed to succeed.
• The vulnerability was not publicly disclosed before the fix was released.
• Microsoft's own risk label is "Exploitation Less Likely."

Microsoft first published the advisory on October 13 and has revised it twice since. On November 6, it added that Paint build 11.2609.401.0 is required "to comprehensively address the vulnerability" and recommended either installing the new version or ensuring it was automatically updated.

In plain terms: this is a relatively low-impact fix that still warrants about a minute of your time because it comes as an app update rather than a monthly Windows patch.

How to check your Microsoft Paint update version

1. Open Paint. You can search for it from the Start menu.
2. Select the Settings gear icon in the top right corner of the Paint window.
3. Look under About Paint for the version number.
4. If it reads 11.2609.401.0 or higher, you already have the fix and are finished.

Image: Microsoft

How to update Paint if you are behind

1. Open the Microsoft Store app.
2. Select Library in the lower left corner.
3. Select Get updates. The Store checks every app, including Paint, and installs what is waiting.
4. Open Paint again and recheck the version under About Paint.

If Paint does not appear in your Library, search the Store for "Paint" and open the Microsoft Corporation listing, which will show an Update button when a newer version is available.

Who needs to pay attention

Anyone who has disabled automatic app updates in the Microsoft Store should check manually, since that setting is what normally delivers the fix. The same applies to family PCs that are rarely powered on, work laptops managed by someone else, and computers that have been offline for a while. If you manage an office or family's computers, add the Store's Get updates option to your existing routine for Windows Update. Built-in Store apps such as Paint receive security fixes on their own schedule.

For broader guidance on keeping older PCs secure, see TechCity's guides on [Windows 10 security updates](https://www.techcityng.com/windows-10-security- updates-extended/) and whether to upgrade a Windows 10 PC now or wait. Phone owners can also check TechCity's explainer on [Android's November security update](https://www.techcityng.com/android-security-update-dropped-calls- fix/).