WHY ON HELL paint has a remote code execution in the name of God?
WHY? is this because someone who needs to build a CV decided to network something on ..... I can't come with a reason why "An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network." will cause paint to start being nice to an attacker and leaking crypto secrets etc.. the thing says sending a specially crafted packet.. this means windows is part of the attack vector, but that just makes the WHY bigger, really, why?
Did the same and it quickly updated itself when I went into the "Paint" page (but I had to go there first). No indication of what just happened a few seconds later.
This seems to affect only paint 11.0.0.0 up to, but not including, 11.2605.91.0.
For folks like me, running a much older version, its probably safe, although its Windows so, I'm not too sure.
I'm amazed MS Paint is somehow up to version 11, let alone 11.2605 (!). I literally can't remember the last time I used it, but what are they even changing?
yes that is my exact situation. I think (hope?) Microsoft would've disclosed it if prior versions were affected too, although I never heard the "old" paint have anything to do with network, so there's that.
> An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.
mspaint.exe is quite likely to have at least one code execution vulnerability if one opens a malicious file, but I bet it's very safe against remote attack :)
> An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.
This site absolutely does jokes, it just doesn't beat horses into bloody pulps with the jokes the way reddit does. We have a higher standard. A joke has to actually be funny, and not some tired reference.
Not to imply any particular comparison to less serious websites where the karma system over time may have resulted in a disproportionate surplus of one liner jokes and other spammy low quality posts.
Presumably this is like many other graphics tool vulnerabilities this works by the attacker persuading a user to open a file that exercises the bug. Not terribly unusual.
I'm no expert but so much of Windows is implemented as services. svchost.exe is probably involved somehow. Like it wouldn't surprise me if Copilot is implemented as a service and it talks to Paint via IPC messages or something
I'm just in full denial that paint runs a server. Happy to be corrected if someone has a windows machine handy to verify.
But From [0]:
> A total of 59 of the October CVEs fit my definition of wormable. Specifically, 57 contain both “An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network” and “No authentication or user interaction is required.”
Makes you wonder if MS is just copy-pasting boilerplate on CVEs and disclosed incorrectly the scope of the one in Paint because they had 56 other bugs to disclose.
So I'm not discounting reporting human error here, yet.
"An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.."
It mentions that it may rely on other services or security measures running- I wonder if there’s something like this hitting a firewall or av and then that calling out to paint to check file type or size out something like that?
Sounds like they just mean opening a file that you got from somewhere else.
>The CVSS score of 8.1 marks this as a high‑severity RCE. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is remote: an attacker can deliver the malicious file over a network connection, for example via Remote Desktop, file shares, or other network‑exposed services that allow users to open images. The lack of EPSS data does not diminish the threat posed by a known RCE, but it does make precise likelihood estimation difficult.
The direct implication is that current generations of ms paint are a “service over the network.” Probably a theoretically possible RPC end point of svchost.exe
I wonder if it could be through a file:// or some deeplink custom url handler that opens in Paint and clicking on it with some carefully crafted file path could make it read out of bounds (since that's the associated weakness reported) and execute something.
Whatever it is, it doesn't require any clicking or user interaction. Maybe my imagination is just limited but I can't imagine why Paint is making itself available for incoming traffic on the network.
I'm thankfully out of the loop on Windows these days, but as I remember it Paint did not have any network features? Is that still true? If if is, maybe it is a misfiling of the CVE and it isn't remote?
Or are they chaining a browser auto opening a download in paint, (but browsers shouldn't do that)...
Why for the love of everything that is good does MS Paint have network trash in it. It's a super simple bitmap editor. Like Notepad, it's simple and just works.
Make a new product and bundle that as an option if you want to drastically change the functionality.
> Notepad in Windows includes AI features powered by Copilot that help refine and shorten text with the assistance of GPT. By default, these AI features are enabled on managed devices
Or maybe after the .bmp file is executed, it can install something that opens an outbound TCP connection to its C2, and thus can receive commands. Would not need admin privileges because it doesn't open a port, just 'outbound' connections, like a long-poll.
Because the definition of "remote" has been expanded in the name of resume-driven development to include sending a malicious file that a victim has to open.
Normally have been 86-ing a number of annoying things such as OneDrive, but leaving Paint in place figuring it's got to still be harmless.
Creeping increases in attack vector when just the opposite is needed more than ever.
> An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.
[1] https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...
UI:N it is with no interaction ?
is it a cve mistake ?
> An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.
>Unproven
>Remediation Level
>Official Fix
>Report Confidence
>Confirmed
I really like these secondary scoring factors, not just scoring the vuln itself, but how it's being attacked.
https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...
Except for the infamous Dropbox comment.
> User Interaction: None
> Out-of-bounds read in Windows Paint allows an unauthorized attacker to execute code over a network.
What server is MS Paint running or what services does it provide?
Edit: Apparently you can use it to print an image from the command-line. Is that how this is being exploited?
But From [0]: > A total of 59 of the October CVEs fit my definition of wormable. Specifically, 57 contain both “An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network” and “No authentication or user interaction is required.”
Makes you wonder if MS is just copy-pasting boilerplate on CVEs and disclosed incorrectly the scope of the one in Paint because they had 56 other bugs to disclose.
So I'm not discounting reporting human error here, yet.
[0] https://www.zerodayinitiative.com/blog/2026/10/13/the-octobe...
But remote? How
Still, the question remains... How?
>The CVSS score of 8.1 marks this as a high‑severity RCE. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is remote: an attacker can deliver the malicious file over a network connection, for example via Remote Desktop, file shares, or other network‑exposed services that allow users to open images. The lack of EPSS data does not diminish the threat posed by a known RCE, but it does make precise likelihood estimation difficult.
https://app.opencve.io/cve/CVE-2026-83844
Should be easy to verify for someone with a windows machine if it does.
Or are they chaining a browser auto opening a download in paint, (but browsers shouldn't do that)...
Make a new product and bundle that as an option if you want to drastically change the functionality.
> Notepad in Windows includes AI features powered by Copilot that help refine and shorten text with the assistance of GPT. By default, these AI features are enabled on managed devices
https://learn.microsoft.com/en-us/windows/client-management/...
I mean… what else were the people working on Notepad and Paint to do!?
The order came down to integrate AI, and they wanted to be promoted.
Every single day I’m happier and happier than I use Linux now.
Or maybe after the .bmp file is executed, it can install something that opens an outbound TCP connection to its C2, and thus can receive commands. Would not need admin privileges because it doesn't open a port, just 'outbound' connections, like a long-poll.
> The vulnerable system can be exploited without any interaction from any user.
[0] https://x.com/orange_8361/status/2115654643141489057?a=qallN...
Cross hatch, Scottish tartan?