Paint.NET 5.1.12

Here are recurring questions and related user issues:

Has Paint.NET had any real, known security vulnerabilities and were they fixed?
Yes. In October 2018, two critical deserialization vulnerabilities (CVE-2018-18446 and CVE-2018-18447) were disclosed for Paint.NET versions prior to 4.1.2. The developer released Paint.NET 4.1.2 and then 4.1.3 within the same week to address these issues, urging users and administrators to update promptly. You can review the official advisories and release notes here: CVE-2018-18446 (NVD), CVE-2018-18447 (NVD), the 4.1.2 release blog post, and the forum announcement confirming that 4.1.2/4.1.3 “address two security vulnerabilities” (forum post).

Was Paint.NET impacted by the 2023 WebP (“libwebp”) vulnerability used in the wild?
Paint.NET supports WebP via a bundled plugin, and many users also install a standalone WebP file-type plugin. After disclosure of the widely exploited WebP heap overflow (CVE-2023-4863), the WebP plugin and Paint.NET’s maintenance releases updated to patched versions of libwebp. The plugin’s releases explicitly bumped to libwebp 1.3.2, while Paint.NET 5.0.11 and 5.0.12 included related stability and security updates. For details and background, see the libwebp security note (Google Groups), the plugin’s release page, and Paint.NET’s 5.0.11 and 5.0.12 blog posts. For broader context, see Microsoft’s MSRC note on CVE-2023-4863 (MSRC blog) and a technical overview by Snyk (Snyk blog).

Are Paint.NET plugins safe, and are they sandboxed?
Paint.NET plugins are standard .NET DLLs that run in-process with the same privileges as the application, and they are not sandboxed. As a result, users should only install plugins from trusted sources, ideally from the author’s thread on the official forum or the project’s documentation links. The official documentation explains how to install plugins and cautions against third-party download sites. See the Plugin API documentation and the official Install Plugins page.

Have there been real-world problems with malicious or misleading third-party plugin packs and download sites?
Yes. Community moderators and the developer have repeatedly warned about deceptive download buttons, unauthorized plugin bundles, and look-alike domains that attempt to distribute adware or unrelated software. Users are advised to obtain Paint.NET from the official website and plugins from the official forum threads maintained by the authors. Examples include a warning about a fake domain (forum discussion) and reports of misleading ads leading to unwanted software (forum thread). The official installation guidance reiterates this advice (Install Plugins).

Why do some antiviruses flag the installer or block Paint.NET temporarily, and is that a known security incident?
Occasionally, antivirus products have flagged Paint.NET installers due to heuristic detections of self-extracting archives or temporary helper executables used during setup. These incidents have typically been false positives rather than indicators of compromise. Reports on the forums document cases involving Malwarebytes and Bitdefender, with recommendations to ensure the installer is from the official source and to allow time for AV definitions to be corrected. See examples from Malwarebytes (community thread) and Bitdefender’s detection of a 5.0.7 installer (forum thread).

What are safe sources for Paint.NET itself and how can users avoid supply-chain risks?
The safest sources are the Microsoft Store listing and the official download page, which provide signed installers and portable packages published by the project. The project also maintains a GitHub “paintdotnet/release” repository that hosts official offline installers and MSIs. Users should avoid third-party portals or mirrors that offer “custom” installers. Official links include the Paint.NET download page and the official releases on GitHub.

Does Paint.NET communicate over the network and what domains are involved when checking for updates?
Paint.NET performs update checks against official domains and downloads releases from the project’s servers when updates are available. A long-running moderator post notes that the application checks with getpaint.net and downloads from dotpdn.com, which can help enterprises define allowlists or monitor outbound traffic appropriately. See the explanation here: Update check and download domains.

Where can I verify that the historic 2018 security issues were addressed in releases?
Beyond the NVD entries, the project’s October 2018 blog posts and forum announcements document the fixes and explain that version 4.1.3 quickly followed 4.1.2 to resolve a GPU compatibility issue while retaining the security patches. You can confirm this in the 4.1.2 release blog, the 4.1.3 release blog, and the forum announcement.

Summary guidance for users and administrators concerned with Paint.NET security
Users and administrators should keep Paint.NET up to date (the 5.x line receives regular maintenance releases), install file-type and effect plugins only from the official forum or bundled sources, and avoid third-party “plugin packs” or imitation download sites. If a security scanner flags an installer, users should verify that it was obtained from the official site and then check the forums for confirmation of false positives while antivirus vendors update their signatures. For plugin security posture and installation guidance, consult the official documentation and curated plugin resources: Install Plugins and the forum’s Plugin Packs index.