A flaw in Windows Paint lets an attacker run code on your computer. The fix waits in the Microsoft Store, not Windows Update

Microsoft reported a security flaw in its Paint app on October 13, 2026.

The flaw lets an attacker send a harmful network message that makes Paint run the attacker's instructions.

Microsoft says the attack needs no sign-in and no tap from the person at the computer.

Microsoft rates the attack hard to carry out. A working attack needs deep knowledge of the target computer.

Microsoft rates the flaw Important, with a score of 8.1 out of 10.

The safe copy of Paint carries the number 11.2609.401.0. Microsoft's own security data names that copy.

Paint is a Microsoft Store app. The fix reaches a computer only when the Store updates Paint.

A normal Windows update does not fix Paint. The Store does.

Until this week, the Store was unable to install the safe copy.

On November 6, 2026, reporters found the safe copy in the Store in ten checked countries.

One tester's computer had already received the safe copy on its own, through Store auto-updates.

Microsoft says no one used the flaw in a real attack when the company published its report.

One Microsoft record still names an older number, 11.2605.91.0, as the safe copy. Microsoft's security data disagrees. The larger number, 11.2609.401.0, is the safe one.

This report concerns people who use Paint on a Windows computer.

Paint is part of Windows, so most Windows computers carry a copy.

The flaw affects the Paint app itself. It does not need a file to be opened or a link to be clicked.

A Store copy of Paint updates separately for each user account on a computer.

Windows can also keep a spare copy that it installs for each new account.

The risk stays until each copy of Paint on the computer reaches the safe number.

Microsoft says the flaw was not used in a real attack when the company published its report. New uses of the flaw can appear at any time.

We do not know how fast the Store update reaches all computers.

We do not know why Microsoft's public records disagree on the safe copy.

We do not know the exact date when the Store offered the safe copy in each country.