Closing the serious hole in Paint is only possible through the Microsoft Store, which administrators can easily overlook

In mid-October Microsoft warned of a vulnerability in Paint that could allow an attacker to execute code remotely, with a severity score of 8.1 out of 10. However, the fixed version is not distributed through Windows Update but only through the Microsoft Store, The Hacker News reports. According to Microsoft, the flaw has not been actively exploited and exploitation is unlikely, because an attacker would need detailed knowledge of the target system.

For a long time the fixed version could not even be found: The Hacker News found that the Store in six countries was still offering an older build, and that an administrator had asked in vain on Microsoft's help forum for the right version as early as 30 October. Build 11.2609.401.0 is now available in all ten countries checked. Microsoft's advisory and the official CVE data do, however, cite different version numbers as the threshold.

Businesses in particular risk missing the update, SOCRadar writes. Organisations that block the Store or distribute apps via management software such as Intune do not receive the fix automatically. Paint is also installed per user profile, so a single PC can hold several copies, SQ Magazine writes. Administrators are advised to check all copies and force an update through the Store.