A stick figure drawn in Microsoft Paint looking confused (Image credit: Microsoft)

Follow us

Add us as a preferred source on Google

I really wasn't expecting Microsoft Paint to turn up in the cybersecurity headlines, but here we are. MS disclosed and patched a security vulnerability within the software on October 13, but it's worth checking your own Paint version to see if you've received the update.

Some users don't have automatic Microsoft Store updates enabled, especially those on work machines. As Paint is updated via the store, you may need to manually update to version 11.2609.401.0 to keep your machine secure.

To confuse things further, International Cyber Digest reports that the MS store was providing older versions to some users until recently, and Windows Latest didn't seem to receive the new version even with auto updates enabled. Or, there's been some mixup with release numbers. It's genuinely difficult to tell at this point, with differing information coming from multiple sources.

The vulnerability was initially given an 8.1 severity rating on the CVSS scale, but Microsoft downgraded it to a 7.0 score on November 9 according to Threat Defence. MS also changed its description of the bug to that of a local exploit (requiring a user to open a crafted file) rather than a network attack vector, .

Regardless, to check whether your Paint version is hopefully up-to-date (what a world we live in), open the app, go to the Settings menu, and check the version number beneath the "About Paint" section. If it's lower than version 11.2609.401.0, open the Microsoft Store and manually update the app. Or, if your Windows 11 settings don't allow user updates, contact your sysadmin.

A screenshot of the settings menu in Microsoft Paint

(Image credit: Microsoft)

You can also check your Paint version within Windows Powershell by running:

powershell Get-AppxPackage -Name Microsoft.Paint | Select-Object Name, Version

Honestly, this is the biggest omnishambles of conflicting cybersecurity info I've seen in a while. Some outlets initially reported the bug as a no-click security flaw, while others have suggested that the vulnerability could potentially be exploited via a specially crafted image. Microsoft shifting the security goalposts as it goes really hasn't helped, nor has its apparently messy roll out of the patched version.

Keep up to date with the most important stories and the best deals, as picked by the PC Gamer team.

Anyway, it's still worth checking if Paint has been updated, folks. One way or another, we'll get to the bottom of this eventually. Or we'll just keep updating every aspect of our machines on a tediously regular basis, in the hope that some of these messy leak-plugging antics might do some good.

Secretlab Titan Evo gaming chair in Royal colouring, on a white background

Andy built his first gaming PC at the tender age of 12, when IDE cables were a thing and high resolution wasn't. 26 years later (yes he's getting old), he now spends his days writing about and reviewing graphics cards, CPUs, keyboards, mice, gaming headsets and much, much more. You name it, if it's PC gaming hardware he'll write words about it, with opinions and everything.