Microsoft Paint needs to be on version 11.2609.401.0 to carry the fix for a security vulnerability the company disclosed and patched on October 13, and not every machine appears to have it.
To check, open Paint, go to Settings and look under "About Paint". You can also run Get-AppxPackage -Name Microsoft.Paint | Select-Object Name, Version in PowerShell. If the number is lower, update through the Microsoft Store. If your Windows 11 settings block user updates, ask your sysadmin.
Delivery is the catch. Paint updates through the Store, and some users, especially on work machines, have automatic Store updates turned off. Even with auto-updates on, accounts conflict. One outlet reported that the Store served older versions to some users until recently, and another said it didn't seem to receive the new build despite auto-updates being enabled. It is not clear whether that is a rollout fault or a mixup in release numbers.
The bug's description has also shifted. It first received an 8.1 on the CVSS scale, a 0-to-10 severity rating. According to a security tracker, Microsoft cut that to 7.0 on November 9 and reworded the flaw as a local exploit, meaning a user must open a crafted file, rather than a network attack. Early coverage had called it a no-click flaw, while other outlets said a specially crafted image could trigger it.
Both scores fall in the "high" band of CVSS, so the downgrade changes the story about how an attacker reaches you more than how urgently you should patch. A bug that needs you to open a file is the familiar phishing-attachment problem, not a worm. But a fix that depends on a Store update is only as good as that update's reach, and with the rollout reports unresolved, the version number in "About Paint" is the only reliable answer.