HN

Need help?
<- Back
MS Paint Remote Code Execution Vulnerability

MS Paint Remote Code Execution Vulnerability

kuberwastaken

Comments (94)

  • xlayn
    WHY ON HELL paint has a remote code execution in the name of God? WHY? is this because someone who needs to build a CV decided to network something on ..... I can't come with a reason why "An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network." will cause paint to start being nice to an attacker and leaking crypto secrets etc.. the thing says sending a specially crafted packet.. this means windows is part of the attack vector, but that just makes the WHY bigger, really, why?
  • Oarch
    I can't wait for the Raymond Chen write up one day.
  • logicallee
    There's no remote code execution vulnerability in Paint. What was going on is that yesterday I put together a prospectus for a $20 stock offering[1] and as part of this I used paint while I created ascii art for the prospectus[2]. A defense contractor is scare mongering that this is somehow a remote code execution vulnerability, probably to sell defense services. As you can see, the cve doesn't contain any actual vulnerability. Paint doesn't have any network code at all. Nor buffer overflows. It's very simple bitmap graphics and was carefully tested. It's a 917 kb binary that has been static tested for 20 years.However, the scare mongering caused my posts to be soft locked as a security precaution. My posts yesterday received around 3,000 views and no comments. I checked before posting yesterday and there were no similar companies, however, mysteriously today there are several "secure" versions of the same startup I mentioned in the prospectus. (For example https://ontimecall.com/ but there are lots of others, many with long SEO stories that didn't exist yesterday.)[1] https://taonexus.com/worthless.txt[2] creative process: https://imgur.com/a/PO7pvCQ
  • greyhound1
    Had to go to Microsoft Store to get the fixed version, Windows Update didn't show anything.
  • everylostbit
    This seems to affect only paint 11.0.0.0 up to, but not including, 11.2605.91.0. For folks like me, running a much older version, its probably safe, although its Windows so, I'm not too sure.
  • what_hn
    Paint opens a port?
  • darepublic
    Is this old or new paint
  • ajasmin
    What Network?
  • dmitrygr
    Oh, this is the modern "paint" trash, not mspaint.exe that i still use, copied out of x64 XP build, together with calc.exe
  • NooneAtAll5
  • patrick_rtk
    wow thoses days are amazing. cve: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HUI:N it is with no interaction ?is it a cve mistake ?
  • layer8
    Fixed in version 11.2609.401.0.
  • TZubiri
    >Exploit Code Maturity>Unproven>Remediation Level>Official Fix>Report Confidence>ConfirmedI really like these secondary scoring factors, not just scoring the vuln itself, but how it's being attacked.
  • paulpauper
    is this as bad as Windows Metafile (WMF) Exploit?
  • falcor84
    Wow! At first sight I was sure it was a joke, but no. What a time...https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...
  • IFC_LLC
    At this point I want to declare that air-gapped network with the transfer only over USB drives is a viable and valuable method of handling IT security. Outside transfer only happens by people manually copying text onto a floppy and reading it from a floppy.I just... It's just ridiculous at this point.
  • 6thbit
    I'm just in full denial that paint runs a server. Happy to be corrected if someone has a windows machine handy to verify.But From [0]: > A total of 59 of the October CVEs fit my definition of wormable. Specifically, 57 contain both “An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network” and “No authentication or user interaction is required.”Makes you wonder if MS is just copy-pasting boilerplate on CVEs and disclosed incorrectly the scope of the one in Paint because they had 56 other bugs to disclose.So I'm not discounting reporting human error here, yet.[0] https://www.zerodayinitiative.com/blog/2026/10/13/the-octobe...
  • tosti
    Code execution, sure, paint has been used to write executable code too, so why not.But remote? How
  • itopaloglu83
    First the notepad CVE and now this, Microsoft is on a roll.
  • reader9274
    Finally my childhood abstract Paint art can take over a server
  • xg15
    Waiting for the 0day RCE in Solitaire next...
  • caust1c
    Looking forward to the CALC.EXE RCE next, so we can pop calc while we pop calc!
  • AlienRobot
    I miss when MS Paint just opened image files and let you do some basic editing, before layers, background removal and RCE's...
  • arm32
    Patch your MS Paint, everybody!
  • anon
    undefined
  • mmargenot
    no my beloved
  • rarisma
    rce in paint i guess bro