Microsoft’s Paint app has a remote code execution flaw, CVE-2026-83844, that was disclosed on October 13, and Windows Latest reports the fix may not reach some PCs even with automatic updates turned on.
The out-of-bounds read is rated 8.1 and Important. Microsoft says it is difficult to exploit and no exploitation in the wild has been reported. Paint versions below 11.2609.401.0 are affected, and the fix ships through the Microsoft Store rather than Windows Update.
The outlet’s own Paint build showed no available update and IT administrators reported the same, so a fully patched Windows install does not guarantee Paint is current. Users can check the installed version with PowerShell and install the newest Paint update available.