More free tools →

WetPaint

Which Store app copies are still vulnerable? Paint, Notepad, Terminal and the codec extensions are patched through the Microsoft Store, not Windows Update. Every account has its own copy, so one PC can hold several versions. Paste one command’s output and see which copies are below the version Microsoft says fixes each CVE.

Nothing you paste leaves your browser.

1Run this in an elevated PowerShell

It lists every Store app for every account on the computer, plus the provisioned copy new profiles start from, and copies the result to your clipboard. 

$a = 'x64'; if ($env:PROCESSOR_ARCHITECTURE -eq 'ARM64') { $a = 'arm64' }
$rows = @(Get-AppxPackage -AllUsers | Where-Object { -not $_.IsFramework } | ForEach-Object {
  $p = $_; $p.PackageUserInformation | ForEach-Object {
    [pscustomobject]@{ n = $p.Name; v = [string]$p.Version; u = [string]$_.UserSecurityId.Username; s = [string]$_.InstallState } } })
$rows += @(Get-AppxProvisionedPackage -Online | ForEach-Object {
  $v = @([string]$_.Version); $m = [Environment]::ExpandEnvironmentVariables([string]$_.InstallLocation)
  if ($m -match 'AppxBundleManifest\.xml$' -and (Test-Path -LiteralPath $m)) {
    $x = [xml](Get-Content -LiteralPath $m -Raw)
    $b = @($x.Bundle.Packages.Package | Where-Object { $_.Type -eq 'application' -and ($_.Architecture -eq $a -or $_.Architecture -eq 'neutral') } | ForEach-Object { [string]$_.Version })
    if ($b.Count) { $v = $b } }
  $n = [string]$_.DisplayName; $v | ForEach-Object { [pscustomobject]@{ n = $n; v = $_; u = '(provisioned)'; s = 'Provisioned' } } })
$rows | ConvertTo-Json -Compress | Set-Clipboard

Already ran the two Paint commands from our Paint post? Paste their output instead; the page reads that too.

2Paste and check

Questions

Why does one computer have several versions of Paint?

Store apps install per account. Each account's copy updates when that account's Store client syncs, so an account nobody has signed in with for months keeps the version it had. New profiles start from the provisioned copy in the Windows image, which can be older again. A computer with three accounts can hold three versions of the same app.

Windows Update and WSUS are current. Why are these behind?

Because neither of them delivers Store apps. The fix for a Store app CVE ships as a Store app update. Fleets that turn the Store off by policy, kiosks and shared PCs that nobody signs in to, and accounts that rarely sign in all keep the old version.

Where do the fixed versions come from?

Microsoft's own security update data (MSRC). When Microsoft fixes a Store app it publishes the fixed app version with the advisory, and that is the number this page compares against. NVD records for these CVEs often name no product at all, which is why most scanners never flag them.

Does this send what I paste anywhere?

No. The page downloads Microsoft's list of Store app fixes from our API and does the comparison in your browser. Nothing you paste leaves this page.

Why does the command read a manifest for the provisioned copy?

Get-AppxProvisionedPackage reports the version of the bundle, not the app inside it. For Terminal the bundle says 3001.24.12741.0 while the app is 1.24.12741.0. The bundle manifest lists the real app versions, so the command reads those instead.

One computer at a time

This page answers for the computer you ran the command on. RFF reads every account’s Store apps on every machine, flags the copies below Microsoft’s fixed version, and can ask the machines to fetch the update from Microsoft, then reports which accounts got it and which get it at their next sign-in.