alt Hacker NewsMS Paint Remote Code Execution Vulnerability
Comments
Had to go to Microsoft Store to get the fixed version, Windows Update didn't show anything.
This seems to affect only paint 11.0.0.0 up to, but not including, 11.2605.91.0. For folks like me, running a much older version, its probably safe, although its Windows so, I'm not too sure.
WHY ON HELL paint has a remote code execution in the name of God? WHY? is this because someone who needs to build a CV decided to network something on ..... I can't come with a reason why "An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network." will cause paint to start being nice to an attacker and leaking crypto secrets etc.. the thing says sending a specially crafted packet.. this means windows is part of the attack vector, but that just makes the WHY bigger, really, why?
reminds me of https://ubuntu.com/security/notices/USN-3246-1
neighbouring post: https://news.ycombinator.com/item?id=50383612
Hold up.
"No User Interaction"
Does that mean that paint doesnt have to be running?
Application being installed on a PC allows a specially crafted packet to arbitrarily execute code?
Fixed in version 11.2609.401.0.
wow thoses days are amazing. cve: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
UI:N it is with no interaction ?
is it a cve mistake ?
Is this old or new paint
Oh, this is the modern "paint" trash, not mspaint.exe that i still use, copied out of x64 XP build, together with calc.exe
LLMs are now unfolding decades of technical debt, poorly written code, and security vulnerabilities accumulated in software built by humans.
Of course.
>Exploit Code Maturity
>Unproven
>Remediation Level
>Official Fix
>Report Confidence
>Confirmed
I really like these secondary scoring factors, not just scoring the vuln itself, but how it's being attacked.
[flagged]
[dead]
[dead]
I love Microsoft! Who else might look at a fully offline drawing app and think: "Man this needs the most severe level of networking access capable of remote code execution", and that surely is to put their useless Copilot to absolutely nowhere. Next headline will be "All user credentials stolen from Notepad"
Wow! At first sight I was sure it was a joke, but no. What a time...
https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...
I'm just in full denial that paint runs a server. Happy to be corrected if someone has a windows machine handy to verify.
But From [0]: > A total of 59 of the October CVEs fit my definition of wormable. Specifically, 57 contain both “An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network” and “No authentication or user interaction is required.”
Makes you wonder if MS is just copy-pasting boilerplate on CVEs and disclosed incorrectly the scope of the one in Paint because they had 56 other bugs to disclose.
So I'm not discounting reporting human error here, yet.
[0] https://www.zerodayinitiative.com/blog/2026/10/13/the-octobe...
https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...
States:
> Attack Vector: Network
> The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet.
The way I read it is MSPaint is now running as a service and listens to a port (while running? all the time?) and you can trigger remote execute by sending data. Just.. Why?..
Code execution, sure, paint has been used to write executable code too, so why not.
But remote? How
At this point I want to declare that air-gapped network with the transfer only over USB drives is a viable and valuable method of handling IT security. Outside transfer only happens by people manually copying text onto a floppy and reading it from a floppy.
I just... It's just ridiculous at this point.
Does this effect the regular Win32 Paint? Who uses the app store crap anyway?
First the notepad CVE and now this, Microsoft is on a roll.
What's next, the space cadet pinball game lol... although jokes on them, I would only play it if I didn't have internet.
Looking forward to the CALC.EXE RCE next, so we can pop calc while we pop calc!
Yep, AI gonna end all software and we come back to air gapped system
The calendar app and my internal clock disagree, is it April 1 today or no?
Finally my childhood abstract Paint art can take over a server
I miss when MS Paint just opened image files and let you do some basic editing, before layers, background removal and RCE's...
If ain't broke don't fix it! Why did they change MS Paint! The campy memes will never be the same.
no my beloved
rce in paint i guess bro
Paint can exectue arbitrary code from the REMOTE, without USER INTERACTION?????
We seriously need more information.