Microsoft Paint RCE fix ships through the Store, not Windows Update
The patched Paint build is 11.2609.401.0, and machines that only take Windows updates won't get it.
Microsoft has published a fix for a remote code execution flaw in Windows Paint, but it arrives only through the Microsoft Store. Windows Update doesn't carry it. The Hacker News reported the fix on 6 November.
The patched build is 11.2609.401.0. The outlet says that build was the newest Paint version in all ten countries it checked that day.
Microsoft's advisory describes the bug as an out-of-bounds read that lets an unauthorized attacker execute code locally, and rates it 7.0 on the CVSS 3.1 scale, high severity. The advisory title calls it a remote code execution vulnerability. The two descriptions don't line up neatly, and the advisory doesn't explain the gap. The CNA vector carries a high attack complexity and requires user interaction, so this isn't a bug anyone triggers by opening Paint and waiting.
The delivery path is the part worth noting. Paint ships as a Store app on current Windows builds, so its patches bypass the update channel many teams treat as their baseline. If your inventory says "Windows is patched", that says nothing about Paint.
Check the Paint version on managed endpoints and push the Store update where you can. We'd also check whether your patch reporting covers Store apps at all, because this won't be the last fix that skips Windows Update.
The source doesn't say whether anyone has exploited the flaw.
CVE references
Sources
- Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver ItPrimarythehackernews.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning
