Microsoft Paint Remote Code Execution Flaw Patched via Store, Windows Update Lags

Out-of-Bounds Read in a Default Windows App

Microsoft Paint, which is preinstalled on every Windows PC, contains a vulnerability caused by an out-of-bounds read that can lead to remote code execution. The affected versions range from 11.0.0.0 to all builds before 11.2605.91.0. This broad range means that a large number of Windows installations are potentially exposed. Microsoft has not disclosed a CVSS severity score, proof-of-concept code, or evidence that the flaw is being exploited in the wild. An out-of-bounds read occurs when an application accesses memory outside the intended buffer; in the context of Paint, that condition is said to enable arbitrary code execution, though the precise trigger—such as a malicious image file or a particular feature—has not been identified.

Feature Creep Introduces New Risk

Paint has undergone a noticeable shift from a basic utility to a more complex application. Microsoft has been adding features at a steady pace, including AI-generated content. This expansion has enlarged the codebase and introduced new bugs alongside new capabilities. The out-of-bounds read flaw is one of those new defects. The recent wave of updates created the conditions for this vulnerability, though which new feature or component is responsible remains unclear. For an app that handles untrusted image files, the addition of AI features and other functions increases the number of code paths that an attacker might probe.

Fix Available Only Through Microsoft Store

The patched build of Paint is available now through Microsoft Store. Users need to open the Store, navigate to the Microsoft Paint page, and install the update manually. Windows Update has not yet pushed the corrected version. This creates a patch-delivery gap: a system can be fully updated through Windows Update and still run a vulnerable Paint app. Many users rely on Windows Update as the central source of security fixes, so the discrepancy is easy to overlook. The version 11.2605.91.0 is the first build that includes the fix, based on the affected range; anything older should be updated. It is unclear whether the fix will later be delivered through Windows Update.

What Users Should Do

The immediate step is to check Microsoft Store for a Paint update and install it. If automatic Store updates are disabled, this requires explicit action. Until the patched version is installed, users should avoid opening image files from untrusted sources. Paint is often associated with common image formats, so a malicious file could be a likely attack vector even if the exact exploit method is unknown. For administrators, the gap between Store and Windows Update means that standard patch-management workflows may not detect the missing fix. They should verify that the updated Paint version reaches endpoints, especially in environments where Microsoft Store access is restricted.