alt Hacker NewsWHY ON HELL paint has a remote code execution in the name of God? WHY? is this because someone who needs to build a CV decided to network something on ..... I can't come with a reason why "An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network." will cause paint to start being nice to an attacker and leaking crypto secrets etc.. the thing says sending a specially crafted packet.. this means windows is part of the attack vector, but that just makes the WHY bigger, really, why?
Replies
Any extraction of behavioural surplus is a win, Nadella went hard on this in Windows 11. If you are drawing something for your child in paint, you might want to buy pampers or something.
my first reaction was "oh_ why??!?, not again_"
not sure if the last time was also a RCE specifically, but this by far isn't the first "this shouldn't even be remotely possible" CVE in MS Paint
llm they use to vibe-code windows was supposed to make no mistakes and make everything secure...
unfortunately it made some mistakes and didn't make everything secure.
im sure windows security will get better as models get better...
maybe in six months when we have AGI... . . .
>I can't come with a reason why "An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network."
The Microsoft link doesn't mention this at all, so my guess it's "remote" in the sense that a zip file exploit is "remote"