Paint vulnerability patch fails to reach some Windows 11 PCs

The company published information about the flaw on October 13 as part of its monthly patch release. On the CVSS scale, the vulnerability received a score of 8.1 out of 10, and under Microsoft's own classification it was categorized as "Important," which is one tier below the critical level. It involves an out-of-bounds read. According to Microsoft's description, the attack is carried out over the network without authorization and with no user interaction: sending a specially crafted network packet to the vulnerable service is enough. At the same time, the company rates the attack complexity as high, and no cases of exploitation had been recorded at the time of disclosure.

Paint receives updates from the Microsoft Store independently of Windows Update, so the October cumulative update for the system does not fix the flaw in the editor. Microsoft currently designates version 11.2609.401.0 as the patched release. According to Kod.ru, the bulletin initially listed build number 11.2605.91.0, which was replaced on November 2.

According to users, the store does not find the new version even during manual checks and with auto-updates enabled, leaving Paint on builds 11.2603.251.0 or 11.2605.81.0. As 3DNews reports citing Windows Latest, downloading the package also failed using third-party tools for MSIX. The reasons are unknown, and Microsoft has not officially commented on the situation.

The installed build number is displayed in Paint's own settings and can also be obtained using the Get-AppxPackage cmdlet in PowerShell. According to Microsoft documentation, builds below 11.2609.401.0 are considered vulnerable.