Microsoft has fixed a serious security flaw in Paint, the drawing app built into Windows 11, and this Microsoft Paint update does not come with your usual Windows Update. The fix is a new version of the Paint app, 11.2609.401.0, delivered through the Microsoft Store. Most PCs will get it on their own, but it takes about a minute to check that yours did.
The short version
Microsoft updated its security notice for a Paint flaw on November 6 to say the full fix is Paint version 11.2609.401.0. Here is how to see which version you have and how to update it if you are behind.
- The flaw is tracked as CVE-2026-83844 and Microsoft rates it Important, with a severity score of 7.0 out of 10, which Microsoft lowered on November 7 after adding more detail.
- Microsoft says the flaw had not been publicly disclosed or used in attacks, and rates attacks as less likely.
- The fix is Paint version 11.2609.401.0, which arrives as a Microsoft Store app update.
- To check, open Paint, select Settings, and look for the version number under About Paint.
- If you are behind, open the Microsoft Store, go to Library and select Get updates.
What Microsoft fixed in Paint
According to Microsoft’s security notice, the bug is an “out-of-bounds read,” which means the app could be tricked into reading memory it should not touch. If an attack worked, the attacker could run their own code on the PC. Microsoft explained on November 7 that the attack happens on the computer itself and needs the user to do something, for example being tricked into downloading and opening a specially made file.
That sounds alarming, so here is the context Microsoft gives in the same notice:
- The attack is rated high complexity. Microsoft says it needs “a deep understanding of the system” and is not guaranteed to work.
- It was not publicly disclosed before the fix, and Microsoft says it has not been exploited.
- Microsoft’s own label for the risk is “Exploitation Less Likely.”
Microsoft first published the notice on October 13 and has revised it twice since. On November 6 it added that a new Paint build, 11.2609.401.0, is needed “to comprehensively address the vulnerability,” and recommended “installing this new version or ensuring that it was automatically updated.”
In plain terms: this is a low drama fix that still deserves a minute of your time, because it lives in an app update, not in the monthly Windows patch most people watch for.
How to check your Microsoft Paint update version
- Open Paint. You can search for it from the Start menu.
- Select the Settings gear icon in the top right corner of the Paint window.
- Look under About Paint for the version number.
- If it reads 11.2609.401.0 or higher, you already have the fix and you are done.
How to update Paint if you are behind
- Open the Microsoft Store app.
- Select Library in the lower left corner.
- Select Get updates. The Store checks every app, including Paint, and installs what is waiting.
- Open Paint again and recheck the version under About Paint.
If Paint does not appear in your Library, search the Store for “Paint” and open the Microsoft Corporation listing, which shows an Update button when a newer version is ready.
Who needs to pay attention
Anyone who has turned off automatic app updates in the Microsoft Store should check by hand, since that setting is what normally pulls the fix in. The same goes for family PCs that are rarely switched on, work laptops where someone else manages updates, and computers that have been offline for a while.
If you look after an office or a family’s computers, add the Store’s Get updates button to the routine you already follow for Windows Update. Built-in Store apps such as Paint can get security fixes on their own schedule.
For the bigger picture on keeping an older PC safe, see TechCity’s guides on Windows 10 security updates and whether to upgrade a Windows 10 PC now or wait. Phone owners can check our explainer on Android’s November security update.
