MS has messily patched a Microsoft Paint security vulnerability, but the update still isn’t showing up for some

I really wasn’t expecting Microsoft Paint to turn up in the cybersecurity headlines, but here we are. MS disclosed and patched a security vulnerability within the software on October 13, but it’s worth checking your own Paint version to see if you’ve received the update.

Some users don’t have automatic Microsoft Store updates enabled, especially those on work machines. As Paint is updated via the store, you may need to manually update to version 11.2609.401.0 to keep your machine secure.

To confuse things further, International Cyber Digest reports that the MS store was providing older versions to some users until recently, and Windows Latest didn’t seem to receive the new version even with auto updates enabled. Or, there’s been some mixup with release numbers. It’s genuinely difficult to tell at this point, with differing information coming from multiple sources.

The vulnerability was initially given an 8.1 severity rating on the CVSS scale, but Microsoft downgraded it to a 7.0 score on November 9 according to Threat Defence. MS also changed its description of the bug to that of a local exploit (requiring a user to open a crafted file) rather than a network attack vector, .

Regardless, to check whether your Paint version is hopefully up-to-date (what a world we live in), open the app, go to the Settings menu, and check the version number beneath the “About Paint” section. If it’s lower than version 11.2609.401.0, open the Microsoft Store and manually update the app. Or, if your Windows 11 settings don’t allow user updates, contact your sysadmin.

You can also check your Paint version within Windows Powershell by running:

powershell Get-AppxPackage -Name Microsoft.Paint | Select-Object Name, Version

Honestly, this is the biggest omnishambles of conflicting cybersecurity info I’ve seen in a while. Some outlets initially reported the bug as a no-click security flaw, while others have suggested that the vulnerability could potentially be exploited via a specially crafted image. Microsoft shifting the security goalposts as it goes really hasn’t helped, nor has its apparently messy roll out of the patched version.

Anyway, it’s still worth checking if Paint has been updated, folks. One way or another, we’ll get to the bottom of this eventually. Or we’ll just keep updating every aspect of our machines on a tediously regular basis, in the hope that some of these messy leak-plugging antics might do some good.