Overview
- Microsoft published a Paint security fix on October 13 through the Microsoft Store, and the company lists build 11.2609.401.0 as the patched version.
- The flaw is an out-of-bounds read that could lead to remote code execution if an attacker sends a specially crafted network packet to an affected service.
- Reporters and IT administrators have found many systems still running older Paint builds such as 11.2603.251.0 even when Store auto-updates are enabled, which suggests a distribution or version-documentation mismatch.
- Some enterprise antivirus tools have flagged Paint as unpatched, creating extra alerts and remediation work for IT teams despite Microsoft saying the bug is hard to exploit and no in‑the‑wild attacks have been seen.
- Users and admins should check Paint’s installed version for every user account and the provisioned copy, then update or reinstall Paint from the Microsoft Store if any copy is below 11.2609.401.0 because Windows cumulative updates do not update Store apps.