Microsoft discloses unauthenticated remote code execution flaw in Windows Paint
- Severity
- High
- Sources
- 1
What happened
Microsoft's October 2026 advisory covers an out-of-bounds read (CWE-125) in Windows Paint enabling remote code execution with no authentication or user interaction, reportedly via a crafted network packet to an unnamed service; no CVE ID is given in the source. Microsoft rates exploitation Less Likely and reports no public disclosure or known exploitation. Version data conflicts: the advisory lists Paint build 11.2609.401.0 as fixed, while the NIST record lists affected versions below 11.2605.91.0, so follow Microsoft's guidance. Some systems reportedly kept receiving older builds, so verify installed versions with Get-AppxPackage Microsoft.Paint and check for updates in the Microsoft Store.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Update Windows Paint through the Microsoft Store to the build listed in Microsoft's October advisory.
- Check the installed Paint version afterwards, for example with the PowerShell command Get-AppxPackage Microsoft.Paint, and compare it with the advisory.
- Administrators should confirm the fix reached every device, since some systems reportedly kept receiving older builds.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Products