Microsoft has quietly patched a serious security hole in Paint, the drawing app that ships with Windows. The fix, however, doesn’t arrive through the usual Windows Update channel — users need to grab it from the Microsoft Store instead.
The vulnerability, tracked as CVE-2026-83844, could let an attacker execute code remotely, earning it an “Important” severity rating with a CVSS score of 8.1. The corrected version is 11.2609.401.0.
There’s a catch for IT administrators: Paint is installed separately for each user account, and Windows may also keep a pre-installed copy for future users. That means checking just your own account isn’t enough — every copy on a machine needs to be verified and updated.
So far, there’s no evidence the flaw has been exploited in the wild, and Microsoft hasn’t offered any workaround.