Microsoft Paint RCE: verify the Store app patch, not just Windows Update

What changed

The current Microsoft Security Update Guide identifies Paint 11.2609.401.0 as the fixed build. Earlier references to 11.2605.91.0 should not replace the current vendor guidance. The CVE was originally published on 13 October 2026.

Technical details

• Update Microsoft Paint through the Microsoft Store to the currently documented fixed build 11.2609.401.0 or a later applicable release.
• Microsoft rates the vulnerability Important; the CVSS 3.1 base score is 8.1.

Why it matters

Paint is serviced as a Store app. Administrators should verify the installed app version rather than use Windows cumulative update compliance as evidence that this app is fixed.

Known limitations

• Microsoft reports Exploited: No and Exploitation Less Likely.
• The network attack vector requires no privileges or user interaction, but attack complexity is high and successful exploitation depends on the environment and configuration.
• Do not infer that every internet-connected PC is directly reachable or vulnerable to a guaranteed attack.

Now check

• Run Get-AppxPackage Microsoft.Paint | Select-Object Name, Version for the current user.
• For fleet inventory, run an elevated Get-AppxPackage -AllUsers Microsoft.Paint | Select-Object Name, Version, PackageFullName.
• Check Microsoft Store app update policy and deployment results, then recheck the installed version. If the documented fixed build is unavailable, track the vendor advisory and your deployment channels.