Security · November 7, 2026
Also published in Português (Brasil)
Microsoft Paint zero-click vulnerability leaves users exposed despite automatic updates
Microsoft disclosed a high-severity security flaw in the Paint application for Windows 11 that allows remote code execution without user interaction. The vulnerability, identified as CVE-2026-83844, was officially announced on October 13, 2026, and carries a severity score of 8.1 out of 10, classifying it as important rather than critical. Attackers can exploit this out-of-bounds read issue by sending specially crafted network packets to affected devices, enabling them to run malicious code on the system without the victim clicking any files or links. This mechanism has led to the vulnerability being described as a zero-click threat, as it does not require any active user engagement to trigger the exploit.
Despite the release of a fix, many users report that the security patch is not being delivered through standard channels. Even with automatic updates enabled in the Microsoft Store, some systems continue to run version 11.2603.251.0 of Paint, which is below the required safe version of 11.2609.401.0. This discrepancy means that users cannot assume their systems are protected simply because they have automatic updates turned on. The issue appears to be widespread, with other users and IT administrators also failing to locate the updated version through the store or by attempting to download the MSIX package directly using third-party tools.
The root cause of the update failure remains unclear. Possibilities include a malfunction in the Microsoft Store's distribution mechanism or an error in the version number listed in Microsoft's security advisory. It is also possible that the specified version has not yet been made available to the public. Microsoft has not provided further clarification on why the patch is not appearing for all users, leaving a gap between the announced fix and the actual deployment status on many devices.
This incident highlights a broader issue within the Windows ecosystem where the operating system and its built-in applications are updated through different mechanisms. While Microsoft fixed over 1,000 security issues in the Windows 11 updates released in October 2026, these system-level patches do not automatically update store-based applications like Paint. Users must independently verify the version of Paint installed on their machines to ensure they are protected. Microsoft advises users to check their Paint version via Windows PowerShell and install the latest available update, even if it is lower than the version cited in the security advisory, until the distribution issue is resolved.
Although no evidence suggests the vulnerability is currently being exploited in the wild, the potential for remote code execution makes it a significant risk. The situation underscores the importance of monitoring individual application versions rather than relying solely on the status of the operating system. Until Microsoft clarifies the update distribution problem, users should remain vigilant and manually check for Paint updates to mitigate the risk of unauthorized code execution on their devices.