Microsoft has unveiled a dangerous vulnerability in Windows Paint that allows attackers to run arbitrary code without needing user interaction or authentication. Tracked as an out-of-bounds read flaw under CWE-125, the issue was disclosed in the company’s October 2026 advisory. Exploitation of this bug could compromise confidentiality, integrity, and availability of Windows systems.
What the Vulnerability Does
The flaw allows a malicious actor to send a specially crafted network packet to a target service, triggering remote code execution on that system. While Microsoft confirms that no login or user click is necessary, the advisory is vague about which specific service or network port is involved. Claims that merely opening a malicious image could activate the flaw are unverified.
Because of environmental variables—such as system configuration and security settings—the exploitability is nontrivial. Microsoft labels successful attacks unlikely without deep knowledge of how the target is set up. The company currently assesses the likelihood of exploitation as “Less Likely,” noting there are no reports of this vulnerability being publicly disclosed before, nor any known real-world attacks exploiting it.
Patch Details and Version Discrepancies
According to Microsoft’s advisory, patched builds start at version 11.2609.401.0 for Paint. Users with versions below 11.2605.91.0 are listed as vulnerable by NIST. This inconsistency underscores the need to follow Microsoft’s most recent guidance and not rely solely on earlier version thresholds.
To verify your system, open the Microsoft Store to check for updates, then confirm the version using PowerShell via Get-AppxPackage Microsoft.Paint | Select-Object Name, Version. Some systems reportedly still display older, vulnerable builds even after update checks.
Organizational Implications and Response Strategy
For enterprises and security operations teams, this security issue represents a clear risk. Even though Microsoft deems active exploitation unlikely, the remote and zero-click nature of the vulnerability means that unpatched systems could be silently compromised under the right conditions.
As with other image-related software flaws, timely patch deployment is crucial. Administrators should ensure the corrected Paint build is installed everywhere it’s used, rather than assuming automatic updates remain applied universally.
WHAT THIS MEANS: This Windows Paint vulnerability marks a serious zero-click risk because it removes the usual requirement for user action—no login, no clicking—yet could still grant full code execution. Organizations should audit all systems, verify Paint’s build version, roll out updates immediately, and maintain visibility over unexpected or inconsistent patch deployments. Going forward, any discrepancy between advisory version thresholds and system status should be treated as a red flag for possible compromise.
