We’re in the middle of our Cyber Essentials Plus renewal, which mostly means working through vulnerability scans and patching whatever they find. Routine stuff. Then, on an otherwise quiet Friday, Kian looked up from the Qualys results and asked: “Did you know Microsoft Paint has a CVE?”
An 8.1. In Paint.
He wasn’t joking. CVE-2026-83844 landed in October’s Patch Tuesday: an out-of-bounds read in Microsoft Paint that Microsoft says allows “an unauthorized attacker to execute code over a network” (their spelling, not ours). It scores 8.1 out of 10: a network attack, no sign-in needed, no user interaction. The program you used to draw wobbly houses in 1998 now has a remote code execution vulnerability.
Before anyone panics: it isn’t being exploited, it hasn’t been publicly disclosed, and Microsoft rates exploitation “less likely” because actually pulling it off is hard. The fix is already out. This is a patch-it-and-move-on bug, not a drop-everything one.
The finding as Qualys reported it on our own scan, deadline and all.
The sneaky part: no Windows update.
Paint stopped being part of Windows proper a while ago; it’s a Microsoft Store app now. Microsoft’s advisory lists exactly one affected product (“Microsoft Paint”), and the fix arrives through the Store rather than Windows Update. If Store updates are blocked or stale on your machines, which is common on tightly locked-down estates, that hole quietly stays open while Windows Update tells you everything is fine.
What this has to do with Cyber Essentials Plus.
Cyber Essentials has a blunt and brilliant rule: high and critical vulnerabilities must be patched within 14 days of the fix being released. No exceptions for apps that seem harmless. Qualys gave our Paint finding a due date of 27 October, exactly 14 days after Patch Tuesday, and it does not care that the app in question is mostly used for cropping screenshots.
That’s the real lesson hiding in the joke: a patch policy can’t have favourites. Attackers don’t go after the software you take seriously; they go after the software you forgot you had.
Three things worth doing this week:
- Let Store apps update. Check that Microsoft Store updates are actually flowing, whether that’s through Intune or the Store itself. Paint’s fix only arrives that way.
- Scan applications, not just Windows. A tool that only reads Windows Update status would never have seen this one. Our Qualys scan did, 10 days ago, with a deadline attached.
- Put a date on every patch. 14 days for high and critical, measured and reported. If that sounds like admin you don’t have time for, that’s rather the point of having us.
And yes, we’ve patched Paint. The renewal rolls on. If Paint can make the list, anything can.
