Rendered at 03:30:57 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
xlayn 3 hours ago [-]
WHY ON HELL paint has a remote code execution in the name of God?
WHY? is this because someone who needs to build a CV decided to network something on ..... I can't come with a reason why "An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network." will cause paint to start being nice to an attacker and leaking crypto secrets etc.. the thing says sending a specially crafted packet.. this means windows is part of the attack vector, but that just makes the WHY bigger, really, why?
gruez 2 hours ago [-]
>I can't come with a reason why "An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network."
The Microsoft link doesn't mention this at all, so my guess it's "remote" in the sense that a zip file exploit is "remote"
24 minutes ago [-]
doubled112 1 hours ago [-]
Put it on a file share and now any file is "remote".
jdiff 23 minutes ago [-]
Remote, and inapplicable. One of the very few things the Microsoft link does mention that no user interaction is required. A banana left out in the walkway still requires the user to go for a walk.
charlieyu1 2 hours ago [-]
Vibe coding
wetpaws 2 hours ago [-]
They downvote you but you are not wrong
augment_me 1 hours ago [-]
Any extraction of behavioural surplus is a win, Nadella went hard on this in Windows 11. If you are drawing something for your child in paint, you might want to buy pampers or something.
dathinab 3 hours ago [-]
my first reaction was "oh_ why??!?, not again_"
not sure if the last time was also a RCE specifically, but this by far isn't the first "this shouldn't even be remotely possible" CVE in MS Paint
novia 3 hours ago [-]
NSA backdoor?
dathinab 3 hours ago [-]
unlikely
IFF there is a NSA backdoor it likely would be:
- not in paint, but something you can't disable/remove in hardened special purpose windows setups
- not be easily usable by 3rd parties, like some auth accidentally accepting some quite specific other password (e.g. due to some bug reading the expected hash from the wrong place) or similar
lets not forget as much as the NSA might want to spy on you they also want to keep China/Russia out of spying on US companies. A traditional RCE in paint is very counter productive for that.
BowBun 2 hours ago [-]
unless they actively work with MS to keep their backdoor fresh, one can reasonably assume a potential backdoor _was_ well-hidden and advanced for the time period when it was introduced. What about after 20 years and LLMs decompiling everything?
jimt1234 3 hours ago [-]
Et tu, Paint?
Oarch 5 hours ago [-]
I can't wait for the Raymond Chen write up one day.
fuzzfactor 3 hours ago [-]
Just after I deployed a "currently patched" system yesterday and failed to uninstall Paint when I had the chance.
Normally have been 86-ing a number of annoying things such as OneDrive, but leaving Paint in place figuring it's got to still be harmless.
Creeping increases in attack vector when just the opposite is needed more than ever.
greyhound1 5 hours ago [-]
Had to go to Microsoft Store to get the fixed version, Windows Update didn't show anything.
gadrev 3 hours ago [-]
Did the same and it quickly updated itself when I went into the "Paint" page (but I had to go there first). No indication of what just happened a few seconds later.
lossyalgo 1 hours ago [-]
Ugh so I have to unblock the Store in my firewall just to get patched. What a PITA.
neuroelectron 4 hours ago [-]
Wow, what a weird confluence of events
pixelpoet 4 hours ago [-]
If MS knew it would drive people to actually use their app store, they would have created the CVE themselves.
ManuelKiessling 3 hours ago [-]
For a split second, I visualized you walking into a brick and mortar Microsoft Store to get your security update done on your laptop, and somewhere in the middle of that split second I caught myself thinking „typical Microsoft“, and then I came to my senses.
pasteleft 1 hours ago [-]
Paint can exectue arbitrary code from the REMOTE, without USER INTERACTION?????
We seriously need more information.
everylostbit 5 hours ago [-]
This seems to affect only paint 11.0.0.0 up to, but not including, 11.2605.91.0.
For folks like me, running a much older version, its probably safe, although its Windows so, I'm not too sure.
tjohns 3 hours ago [-]
I'm amazed MS Paint is somehow up to version 11, let alone 11.2605 (!). I literally can't remember the last time I used it, but what are they even changing?
Legend2440 3 hours ago [-]
They've added a lot of features and it's almost like Photoshop Elements now. It has layers, general photo editing tools, an AI generator, etc.
anal_reactor 2 hours ago [-]
I remember that when Paint started being funky I found a Windows XP exe and used that. I want Paint to be the graphical equivalent of hexedit.
Now that I'm on Linux, I use jspaint.app.
pasteleft 56 minutes ago [-]
Honestly I like layers in Paint. Even pixel art programs have layers.
bombcar 2 hours ago [-]
Just like any text editor is doomed to become either Emacs or Word, so any image editor is doomed to become Photoshop.
wilkystyle 1 hours ago [-]
Too true. I gave up trying to fight it years ago and now write all my documents in Emacs and edit my code with Microsoft Word.
JdeBP 2 hours ago [-]
It's the last two digits of the year plus the month number. That was June 2026. It was 2504 in May 2025, and 2402 in March 2024.
what 1 hours ago [-]
>2605
>june 2026
Pretty sure it would be May?
But in either case they had 91 releases that month?
JdeBP 37 minutes ago [-]
You haven't spotted that it's regularly being released the month following the revision number. (-: Because Microsoft will of course have a release pipeline that things have to go through.
They're not a positional notation. It's version 11.2605.91 recently. It was 11.2605.81 earlier this year. There was an 11.2605.71 and an 11.2605.61 before that. Last year, there was a 11.2504.451 . The year before there was a 11.2402.32 .
Microsoft's versioning systems are not 4 columns where a tick around of one increments the one before it. The easiest way to think of them is madness made for marketing purposes. (Windows NT starting at 3.1, for example.) There is some logic to it, but nowadays it's often four entirely different things jammed together, ticking around independently. Like the version of Windows, the year and month of the release, and perhaps a daily build number or some such.
Windows NT itself has a monotonically increasing build number as part of its versioning that started some time in 1992 and is currently just over 26 thousand.
gnabgib 1 hours ago [-]
Call a paleontologist, it kooks like we've found a Java developer
Rexxar 1 hours ago [-]
Maybe someone insisted to start counting month at zero.
jval43 3 hours ago [-]
They added AI.
StilesCrisis 3 hours ago [-]
The Windows 11 version is a complete rewrite.
CursedSilicon 3 hours ago [-]
So was the Windows 7 version
Kapura 4 hours ago [-]
This was my observation too; I assume 11.0.0.0 is windows 11? because my windows 10 mspaint doesn't even match that numbering format.
everylostbit 3 hours ago [-]
yes that is my exact situation. I think (hope?) Microsoft would've disclosed it if prior versions were affected too, although I never heard the "old" paint have anything to do with network, so there's that.
novia 2 hours ago [-]
My version shows "22H2" I don't know if I'm vulnerable or not
Yes, when it launches, it opens a telnet server so that bill gates can log in and type all the colors for you to use, like #000000, #000001, etc
ajasmin 5 hours ago [-]
What Network?
hoppp 5 hours ago [-]
It's probably a way to get phished, if you click on a malicious bmp file.
Arainach 4 hours ago [-]
MSRC[1] says otherwise:
> An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.
wow thoses days are amazing.
cve: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
UI:N it is with no interaction ?
is it a cve mistake ?
jdiff 4 hours ago [-]
Doesn't seem to be:
> An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.
akerl_ 1 hours ago [-]
That looks like a placeholder text they drop in the FAQ for anything tagged as RCE.
Until somebody connects the dots on how the heck MS Paint is accessible over the network, I'm gonna maintain some pretty intense skepticism here.
mspaint.exe is quite likely to have at least one code execution vulnerability if one opens a malicious file, but I bet it's very safe against remote attack :)
Razengan 1 hours ago [-]
Of course.
TZubiri 6 hours ago [-]
>Exploit Code Maturity
>Unproven
>Remediation Level
>Official Fix
>Report Confidence
>Confirmed
I really like these secondary scoring factors, not just scoring the vuln itself, but how it's being attacked.
paulpauper 4 hours ago [-]
is this as bad as Windows Metafile (WMF) Exploit?
dathinab 2 hours ago [-]
with the limited available information it looks a few _magnitudes_ worse :(
smjy_studio 1 hours ago [-]
[flagged]
falcor84 6 hours ago [-]
Wow! At first sight I was sure it was a joke, but no. What a time...
Presumably this is like many other graphics tool vulnerabilities this works by the attacker persuading a user to open a file that exercises the bug. Not terribly unusual.
yread 6 hours ago [-]
I don't think so:
> User Interaction: None
> Out-of-bounds read in Windows Paint allows an unauthorized attacker to execute code over a network.
criddell 6 hours ago [-]
> An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network.
What server is MS Paint running or what services does it provide?
Edit: Apparently you can use it to print an image from the command-line. Is that how this is being exploited?
80fj0348i 6 hours ago [-]
MS Paint has Copilot now
criddell 6 hours ago [-]
Does that turn it into a server or service?
80fj0348i 5 hours ago [-]
I'm no expert but so much of Windows is implemented as services. svchost.exe is probably involved somehow. Like it wouldn't surprise me if Copilot is implemented as a service and it talks to Paint via IPC messages or something
steve1977 5 hours ago [-]
But that alone wouldn't make the service listen on the network, even if it were the case.
80fj0348i 2 hours ago [-]
It would make sense that it could listen for messages like "your generated image is ready!" and pass bitmap data to Paint. And media like images are a common source of vulnerabilities since you're basically passing binary data into the software.
lakeviewterrace 6 hours ago [-]
IIS (Internet Impasto Server)
dist-epoch 5 hours ago [-]
This site doesn't do jokes
wolttam 3 hours ago [-]
At least not about serious security matters
Sohcahtoa82 3 hours ago [-]
This site absolutely does jokes, it just doesn't beat horses into bloody pulps with the jokes the way reddit does. We have a higher standard. A joke has to actually be funny, and not some tired reference.
Except for the infamous Dropbox comment.
knottn 5 hours ago [-]
Not to imply any particular comparison to less serious websites where the karma system over time may have resulted in a disproportionate surplus of one liner jokes and other spammy low quality posts.
stygiansonic 6 hours ago [-]
When they find a CVE RCE in minesweeper then you know it’s all over
Still able to happily play rounds of Minesweeper on my 286-16!
steve1977 5 hours ago [-]
Not out of the box.
linux2647 5 hours ago [-]
Turns out we were sweeping for CVEs, not mines, all along
lakeviewterrace 6 hours ago [-]
Of course the valuable link is down-weighted/buried in the HN discussion...
>Publicly disclosed
>No
>Exploited
>No
>Exploitability assessment
>Exploitation Less Likely
6thbit 3 hours ago [-]
I'm just in full denial that paint runs a server. Happy to be corrected if someone has a windows machine handy to verify.
But From [0]:
> A total of 59 of the October CVEs fit my definition of wormable. Specifically, 57 contain both “An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network” and “No authentication or user interaction is required.”
Makes you wonder if MS is just copy-pasting boilerplate on CVEs and disclosed incorrectly the scope of the one in Paint because they had 56 other bugs to disclose.
So I'm not discounting reporting human error here, yet.
Code execution, sure, paint has been used to write executable code too, so why not.
But remote? How
gregschlom 6 hours ago [-]
"An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.."
Still, the question remains... How?
IanCal 6 hours ago [-]
It mentions that it may rely on other services or security measures running- I wonder if there’s something like this hitting a firewall or av and then that calling out to paint to check file type or size out something like that?
zmmmmm 3 hours ago [-]
It still makes it sound like the problem really is the other service that is letting a remote connection invoke some part of MS paint.
nonethewiser 6 hours ago [-]
Sounds like they just mean opening a file that you got from somewhere else.
>The CVSS score of 8.1 marks this as a high‑severity RCE. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is remote: an attacker can deliver the malicious file over a network connection, for example via Remote Desktop, file shares, or other network‑exposed services that allow users to open images. The lack of EPSS data does not diminish the threat posed by a known RCE, but it does make precise likelihood estimation difficult.
Sounds like it might be automatically opening a file that was sent over the network without any user interaction.
eqvinox 5 hours ago [-]
Reading tea leaves is still reading tea leaves, even if you make an AI do it… (which is what this is, judging by other things I've seen on opencve.io)
jdiff 3 hours ago [-]
Yeah, OpenCVE also includes this:
> After applying the update, verify that the target Windows systems are running a version that includes the CVE fix before disabling legacy file‑open processing in Paint.
Which is complete nonsense. "Legacy file-open processing" isn't a real configurable option in Paint and this seems to suggest that enabling it is some sort of mitigation. The resolution is simply to update Paint.
Den_VR 6 hours ago [-]
The direct implication is that current generations of ms paint are a “service over the network.” Probably a theoretically possible RPC end point of svchost.exe
VorpalWay 6 hours ago [-]
I'm thankfully out of the loop on Windows these days, but as I remember it Paint did not have any network features? Is that still true? If if is, maybe it is a misfiling of the CVE and it isn't remote?
Or are they chaining a browser auto opening a download in paint, (but browsers shouldn't do that)...
augment_me 2 hours ago [-]
If they know what you paint/edit, they can sell you ads better
kuboble 6 hours ago [-]
These days paint has copilot...
radicalbyte 6 hours ago [-]
Why for the love of everything that is good does MS Paint have network trash in it. It's a super simple bitmap editor. Like Notepad, it's simple and just works.
Make a new product and bundle that as an option if you want to drastically change the functionality.
waz0wski 6 hours ago [-]
Hate to break it to you..
> Notepad in Windows includes AI features powered by Copilot that help refine and shorten text with the assistance of GPT. By default, these AI features are enabled on managed devices
This is the only network feature paint has iirc, so that's probably it.
jdiff 3 hours ago [-]
It's the only network feature I can think of, but what is it doing opening a port to wait and listen for anything?
6thbit 4 hours ago [-]
I wonder if it could be through a file:// or some deeplink custom url handler that opens in Paint and clicking on it with some carefully crafted file path could make it read out of bounds (since that's the associated weakness reported) and execute something.
jdiff 4 hours ago [-]
Whatever it is, it doesn't require any clicking or user interaction. Maybe my imagination is just limited but I can't imagine why Paint is making itself available for incoming traffic on the network.
6thbit 3 hours ago [-]
Ah, no interaction. Yikes, doesn't make sense Paint would have a server tho.
Should be easy to verify for someone with a windows machine if it does.
TZubiri 6 hours ago [-]
Maybe because a .bmp file could be sent remotely.
Or maybe after the .bmp file is executed, it can install something that opens an outbound TCP connection to its C2, and thus can receive commands. Would not need admin privileges because it doesn't open a port, just 'outbound' connections, like a long-poll.
jdiff 3 hours ago [-]
Sending a BMP file that the user has to open doesn't match what little published details we have:
> The vulnerable system can be exploited without any interaction from any user.
TZubiri 1 hours ago [-]
you are right, it seems like the latter outbouns tcp connection is already being opened by paint, and that is what is exploitable.
since it exposes no port, I’d assume it isn’t trivial to exploit, paint will chose its target (a microsoft domain or IP), the exploit must involve some error in destination selection, or simply allowing a mitm to impersonate microsoft.
this is inline with Attack Complexity High, attacker needs to be either in the network path (mitm) or control the erroneous destination of the connection (say mircosoft.com), possibly blocking (dosing) the higher priority genuine destination
jdiff 26 minutes ago [-]
Seems odd even for a vibecoded copilot integration to make repeated, unprompted network requests. And if they're not repeated and unprompted, then we don't meet the "no user input" requirement.
Sohcahtoa82 6 hours ago [-]
Because the definition of "remote" has been expanded in the name of resume-driven development to include sending a malicious file that a victim has to open.
IFC_LLC 3 hours ago [-]
At this point I want to declare that air-gapped network with the transfer only over USB drives is a viable and valuable method of handling IT security. Outside transfer only happens by people manually copying text onto a floppy and reading it from a floppy.
I just... It's just ridiculous at this point.
JeppyG 2 hours ago [-]
What's next, the space cadet pinball game lol... although jokes on them, I would only play it if I didn't have internet.
itopaloglu83 5 hours ago [-]
First the notepad CVE and now this, Microsoft is on a roll.
hmartin 57 minutes ago [-]
The calendar app and my internal clock disagree, is it April 1 today or no?
xg15 5 hours ago [-]
Waiting for the 0day RCE in Solitaire next...
doublerabbit 4 hours ago [-]
Hate to think what Minesweeper has in store.
xg15 4 hours ago [-]
The results will be explosive.
NooneAtAll5 1 hours ago [-]
I sooo want to wrangle in a joke about minesweeper being coNP-complete, somehow
caust1c 5 hours ago [-]
Looking forward to the CALC.EXE RCE next, so we can pop calc while we pop calc!
darkamaul 5 hours ago [-]
Orange Tsai almost did that last week where he used calc to pop Edge [0] to reverse the chain where edge popped calc
The Microsoft link doesn't mention this at all, so my guess it's "remote" in the sense that a zip file exploit is "remote"
not sure if the last time was also a RCE specifically, but this by far isn't the first "this shouldn't even be remotely possible" CVE in MS Paint
IFF there is a NSA backdoor it likely would be:
- not in paint, but something you can't disable/remove in hardened special purpose windows setups
- not be easily usable by 3rd parties, like some auth accidentally accepting some quite specific other password (e.g. due to some bug reading the expected hash from the wrong place) or similar
lets not forget as much as the NSA might want to spy on you they also want to keep China/Russia out of spying on US companies. A traditional RCE in paint is very counter productive for that.
Normally have been 86-ing a number of annoying things such as OneDrive, but leaving Paint in place figuring it's got to still be harmless.
Creeping increases in attack vector when just the opposite is needed more than ever.
We seriously need more information.
Now that I'm on Linux, I use jspaint.app.
>june 2026
Pretty sure it would be May?
But in either case they had 91 releases that month?
They're not a positional notation. It's version 11.2605.91 recently. It was 11.2605.81 earlier this year. There was an 11.2605.71 and an 11.2605.61 before that. Last year, there was a 11.2504.451 . The year before there was a 11.2402.32 .
Microsoft's versioning systems are not 4 columns where a tick around of one increments the one before it. The easiest way to think of them is madness made for marketing purposes. (Windows NT starting at 3.1, for example.) There is some logic to it, but nowadays it's often four entirely different things jammed together, ticking around independently. Like the version of Windows, the year and month of the release, and perhaps a daily build number or some such.
Windows NT itself has a monotonically increasing build number as part of its versioning that started some time in 1992 and is currently just over 26 thousand.
Are you using Windows? If so, then yes.
> An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.
[1] https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...
"No User Interaction"
Does that mean that paint doesnt have to be running?
Application being installed on a PC allows a specially crafted packet to arbitrarily execute code?
0. My gut says this is somehow related to indexing/thumbnail rendering. But maybe I'm off base.
1. The 'no user interaction' could be related to (ironically) some background pre-indexing process that windows is doing on files inserted to folders.
1.1. LOL maybe their bullshit 'Windows Copilot' which is why the description is so vague, don't want to torpedo things worse than they already are.
2. It could also be, still in the category of 'well, ok they click on a share folder and the preview runs' or a weird edge thing.
2.1. But they aren't being that clear yet, probably because it's bad.
UI:N it is with no interaction ?
is it a cve mistake ?
> An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.
Until somebody connects the dots on how the heck MS Paint is accessible over the network, I'm gonna maintain some pretty intense skepticism here.
> https://share.google/aDP2ac9j5AmB13QRo
My take is that the addition of CoPilot to MS Paint is probably how this CVE got introduced.
[0]: https://liquidninja.com/metapad/download.html
>Unproven
>Remediation Level
>Official Fix
>Report Confidence
>Confirmed
I really like these secondary scoring factors, not just scoring the vuln itself, but how it's being attacked.
https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...
> User Interaction: None
> Out-of-bounds read in Windows Paint allows an unauthorized attacker to execute code over a network.
What server is MS Paint running or what services does it provide?
Edit: Apparently you can use it to print an image from the command-line. Is that how this is being exploited?
Except for the infamous Dropbox comment.
But From [0]: > A total of 59 of the October CVEs fit my definition of wormable. Specifically, 57 contain both “An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network” and “No authentication or user interaction is required.”
Makes you wonder if MS is just copy-pasting boilerplate on CVEs and disclosed incorrectly the scope of the one in Paint because they had 56 other bugs to disclose.
So I'm not discounting reporting human error here, yet.
[0] https://www.zerodayinitiative.com/blog/2026/10/13/the-octobe...
But remote? How
Still, the question remains... How?
>The CVSS score of 8.1 marks this as a high‑severity RCE. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is remote: an attacker can deliver the malicious file over a network connection, for example via Remote Desktop, file shares, or other network‑exposed services that allow users to open images. The lack of EPSS data does not diminish the threat posed by a known RCE, but it does make precise likelihood estimation difficult.
https://app.opencve.io/cve/CVE-2026-83844
> After applying the update, verify that the target Windows systems are running a version that includes the CVE fix before disabling legacy file‑open processing in Paint.
Which is complete nonsense. "Legacy file-open processing" isn't a real configurable option in Paint and this seems to suggest that enabling it is some sort of mitigation. The resolution is simply to update Paint.
Or are they chaining a browser auto opening a download in paint, (but browsers shouldn't do that)...
Make a new product and bundle that as an option if you want to drastically change the functionality.
> Notepad in Windows includes AI features powered by Copilot that help refine and shorten text with the assistance of GPT. By default, these AI features are enabled on managed devices
https://learn.microsoft.com/en-us/windows/client-management/...
I mean… what else were the people working on Notepad and Paint to do!?
The order came down to integrate AI, and they wanted to be promoted.
Every single day I’m happier and happier than I use Linux now.
Should be easy to verify for someone with a windows machine if it does.
Or maybe after the .bmp file is executed, it can install something that opens an outbound TCP connection to its C2, and thus can receive commands. Would not need admin privileges because it doesn't open a port, just 'outbound' connections, like a long-poll.
> The vulnerable system can be exploited without any interaction from any user.
since it exposes no port, I’d assume it isn’t trivial to exploit, paint will chose its target (a microsoft domain or IP), the exploit must involve some error in destination selection, or simply allowing a mitm to impersonate microsoft.
this is inline with Attack Complexity High, attacker needs to be either in the network path (mitm) or control the erroneous destination of the connection (say mircosoft.com), possibly blocking (dosing) the higher priority genuine destination
I just... It's just ridiculous at this point.
[0] https://x.com/orange_8361/status/2115654643141489057?a=qallN...
Cross hatch, Scottish tartan?