Paint has a no-click security flaw. Your PC might’ve missed the patch

Dangerous security vulnerabilities can occur in virtually any Windows app. Now it’s Microsoft Paint’s turn. The well-known Windows drawing app contains a vulnerability that attackers can exploit to inject malicious code. The user doesn’t even need to click on anything for it to happen.

Microsoft rated the threat posed by the CVE-2026-83844 vulnerability at 8.1 out of 10 and released a fix on October 13th, which was the last major Patch Tuesday. The problem? That patch apparently never reached some users, meaning the Paint app remains unpatched and vulnerable.

This was reported by Windows Latest, who checked the version of the Paint app on their system. It corresponded to the version number prior to the security patch (in this case 11.2603.251.0) and not the recommended patched version (which should be 11.2609.401.0).

Some antivirus software apparently flagged Paint as unpatched, and some users and administrators noticed that their version of Paint had apparently not been updated. It’s still unclear whether the fault lies in the distribution of the update or in Paint itself. Both Windows Latest and other affected users had automatic updates correctly enabled in their settings.