// PC GAMER — GAMING
MS has messily patched a Microsoft Paint security vulnerability, but the update still isn’t showing up for some
When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.
I really wasn't expecting Microsoft Paint to turn up in the cybersecurity headlines, but here we are. MS disclosed and patched a security vulnerability within the software on October 13, but it's worth checking your own Paint version to see if you've received the update.
Some users don't have automatic Microsoft Store updates enabled, especially those on work machines. As Paint is updated via the store, you may need to manually update to version 11.2609.401.0 to keep your machine secure.
To confuse things further, International Cyber Digest reports that the MS store was providing older versions to some users until recently, and Windows Latest didn't seem to receive the new version even with auto updates enabled. Or, there's been some mixup with release numbers. It's genuinely difficult to tell at this point, with differing information coming from multiple sources.
The vulnerability was initially given an 8.1 severity rating on the CVSS scale, but Microsoft downgraded it to a 7.0 score on November 9 according to Threat Defence. MS also changed its description of the bug to that of a local exploit (requiring a user to open a crafted file) rather than a network attack vector, .
Regardless, to check whether your Paint version is hopefully up-to-date (what a world we live in), open the app, go to the Settings menu, and check the version number beneath the "About Paint" section. If it's lower than version 11.2609.401.0, open the Microsoft Store and manually update the app. Or, if your Windows 11 settings don't allow user updates, contact your sysadmin.
You can also check your Paint version within Windows Powershell by running:
Honestly, this is the biggest omnishambles of conflicting cybersecurity info I've seen in a while. Some outlets initially reported the bug as a no-click security flaw, while others have suggested that the vulnerability could potentially be exploited via a specially crafted image. Microsoft shifting the security goalposts as it goes really hasn't helped, nor has its apparently messy roll out of the patched version.
Keep up to date with the most important stories and the best deals, as picked by the PC Gamer team.
Anyway, it's still worth checking if Paint has been updated, folks. One way or another, we'll get to the bottom of this eventually. Or we'll just keep updating every aspect of our machines on a tediously regular basis, in the hope that some of these messy leak-plugging antics might do some good.