https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...

> User Interaction: None

> Out-of-bounds read in Windows Paint allows an unauthorized attacker to execute code over a network.

  >Publicly disclosed
  >No

  >Exploited
  >No

  >Exploitability assessment
  >Exploitation Less Likely

Except for the infamous Dropbox comment.

But remote? How

Or are they chaining a browser auto opening a download in paint, (but browsers shouldn't do that)...

Make a new product and bundle that as an option if you want to drastically change the functionality.

> Notepad in Windows includes AI features powered by Copilot that help refine and shorten text with the assistance of GPT. By default, these AI features are enabled on managed devices

https://learn.microsoft.com/en-us/windows/client-management/...

I mean… what else were the people working on Notepad and Paint to do!?

The order came down to integrate AI, and they wanted to be promoted.

Every single day I’m happier and happier than I use Linux now.

Still, the question remains... How?

> After applying the update, verify that the target Windows systems are running a version that includes the CVE fix before disabling legacy file‑open processing in Paint.

Which is complete nonsense. "Legacy file-open processing" isn't a real configurable option in Paint and this seems to suggest that enabling it is some sort of mitigation. The resolution is simply to update Paint.

Or maybe after the .bmp file is executed, it can install something that opens an outbound TCP connection to its C2, and thus can receive commands. Would not need admin privileges because it doesn't open a port, just 'outbound' connections, like a long-poll.

> The vulnerable system can be exploited without any interaction from any user.

since it exposes no port, I’d assume it isn’t trivial to exploit, paint will chose its target (a microsoft domain or IP), the exploit must involve some error in destination selection, or simply allowing a mitm to impersonate microsoft.

this is inline with Attack Complexity High, attacker needs to be either in the network path (mitm) or control the erroneous destination of the connection (say mircosoft.com), possibly blocking (dosing) the higher priority genuine destination

Should be easy to verify for someone with a windows machine if it does.

So I guess either some random OS component is listening to the network and just-as-inexplicably asking Paint to do something for it. Or one of Paint's outbound connections is vulnerable if hijacked by a mitm. Network interception's one of the examples used for the "High" Attack Complexity rating that MS gave this CVE. Maybe powered by eMudhra for any systems that haven't revoked those certs? That'd be topical.

>Unproven

>Remediation Level

>Official Fix

>Report Confidence

>Confirmed

I really like these secondary scoring factors, not just scoring the vuln itself, but how it's being attacked.

Cross hatch, Scottish tartan?

> An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

[1] https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...

You haven't declared any privileged knowledge of this attack or MS Paint and have, on vibes, doubled down on what you assume must be going on despite other evidence.

It's a bad look.

You don't have to comment on other people's comments you know.

A significant chunk of the world's problems today are caused by or exacerbated by people who confidently assert things they believe regardless of what evidence or experts say, and who dismiss expertise. Those people are emboldened by others allowing them to spew nonsense unchecked, and I have no interest in seeing HN degraded similarly.

You're moving goalposts. A commenter asked what Networking MS Paint had in the context of this vulnerability. You made an assertion not supported by the documentation we had, and now you're trying to claim that there could be other vulnerabilities rather than admitting that you made a mistake without doing any research.

Normally have been 86-ing a number of annoying things such as OneDrive, but leaving Paint in place figuring it's got to still be harmless.

Creeping increases in attack vector when just the opposite is needed more than ever.

I understood that reference.

Like when a previously sturdy old sailing ship starts taking on water, for instance in the 18th century and beyond.

Numerical equivalent to "deep-six."

Turns out paint was the thing almost every customer had installed/had access to, so he worked to the lowest common denominator and got really good at using it. I guess now he'll need to find a new tool to astonish devs with.

And at the end of the day $2 and $2000 screwdrivers are both still screwdrivers.

Then they added automatic HTML parsing of incoming emails, and the attackers cheered.

You can go back to mutt's parsing, and CVE-1999-0940 for an old example. But I'm sure that's only one of many.

once Microsoft has reinvented themselves as…security-first?

And there is the SFI program.

However this is a Windows application, and in spite some Rust advances in WinDev, it is pretty much C and C++ turf, with Rust getting the same warm reception as .NET used to enjoy.

Guess which language is Paint written on?

Nontheless, they are doubling down on sandboxing Windows, macOS, iOS and Android style, for quite some time, exactly to become security first as you are asking for.

Now that I'm on Linux, I use jspaint.app.

I would use kolourpaint but for whatever reason overlaid GUI elements like the selection box and brush cursors leave trails on the canvas.

Fun anecdote, paint.exe crashed the other day just as I was finishing up my drawing of the tower of Babel.

https://hn.algolia.com/?q=mspaint+ide

[^1]: https://lawsofsoftwareengineering.com/laws/zawinskis-law/

[^2]: https://www.jwz.org/hacks/

Anyway, I continued using layers and transparency/opacity. Pixel art was hard enough already for me, so I didn’t feel that it made sense to artificially make it even more difficult for myself at the time. I had enough other aspects of pixel art to work out already in order to try to get better at it.

There's this https://www.windowsphoneinfo.com/threads/why-does-resizing-m... (made confusing by the next person talking about Paint 3D, a different application) and this https://learn.microsoft.com/en-us/answers/questions/3991946/... (made confusing by the person being an artist and talking in peanut butter metaphors).

But I've only used the program for less than 5 minutes, so maybe it's configured differently?

I don't know why you are so concerned, but it's incredibly easy to test these questions if you really want to know.

The point of paint is a tiny pixel editor. If you want layers there are better programs.

>june 2026

Pretty sure it would be May? But in either case they had 91 releases that month?

They're not a positional notation. It's version 11.2605.91 recently. It was 11.2605.81 earlier this year. There was an 11.2605.71 and an 11.2605.61 before that. Last year, there was a 11.2504.451 . The year before there was a 11.2402.32 .

Microsoft's versioning systems are not 4 columns where a tick around of one increments the one before it. The easiest way to think of them is madness made for marketing purposes. (Windows NT starting at 3.1, for example.) There is some logic to it, but nowadays it's often four entirely different things jammed together, ticking around independently. Like the version of Windows, the year and month of the release, and perhaps a daily build number or some such.

Windows NT itself has a monotonically increasing build number as part of its versioning that started some time in 1992 and is currently just over 26 thousand.

[0] https://x.com/orange_8361/status/2115654643141489057?a=qallN...

UI:N it is with no interaction ?

is it a cve mistake ?

> An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

Until somebody connects the dots on how the heck MS Paint is accessible over the network, I'm gonna maintain some pretty intense skepticism here.

If I still mamaged any windows host, i would be deploying a remove-package script asap to the entire fleet.

When did y'all stop using some basic sense before writing? -_-

Yeah samesame:

-Compares a kernel with paint

-Uses a program with telemetry/spyware instead of installing on of the 1000s alternatives

Oh no dont get me wrong, it's not random spyware, it's deliberately made spyware by Microsoft targeted at Windows Users.

https://interestingengineering.com/culture/rip-microsoft-pai...

Good for you.

Now only <all Windows users>-1 are affected.

But From [0]: > A total of 59 of the October CVEs fit my definition of wormable. Specifically, 57 contain both “An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network” and “No authentication or user interaction is required.”

Makes you wonder if MS is just copy-pasting boilerplate on CVEs and disclosed incorrectly the scope of the one in Paint because they had 56 other bugs to disclose.

So I'm not discounting reporting human error here, yet.

[0] https://www.zerodayinitiative.com/blog/2026/10/13/the-octobe...

IFF there is a NSA backdoor it likely would be:

- not in paint, but something you can't disable/remove in hardened special purpose windows setups

- not be easily usable by 3rd parties, like some auth accidentally accepting some quite specific other password (e.g. due to some bug reading the expected hash from the wrong place) or similar

lets not forget as much as the NSA might want to spy on you they also want to keep China/Russia out of spying on US companies. A traditional RCE in paint is very counter productive for that.

One one hand they can actively try to work with companies to get secret back doors put in, sure. But I imagine that's not usually very successful. Lavabit chose to go out of business instead of doing so... I wonder who else is out there that we don't know about.

But we also have evidence that they actively look for, buy, and hoard, unknown (to the vendor) exploits for their own possible later use in case they need it for something.

I'm sure you can imagine that it's much more advantageous to keep collecting all kinds of different ways to get into a system in case one method is not applicable for any number of reasons.

not sure if the last time was also a RCE specifically, but this by far isn't the first "this shouldn't even be remotely possible" CVE in MS Paint

The Microsoft link doesn't mention this at all, so my guess it's "remote" in the sense that a zip file exploit is "remote"

This is some Eric-Cantona-level gnomic mysticism. I approve.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...

> How could an attacker exploit this vulnerability?

> An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required..

unfortunately it made some mistakes and didn't make everything secure.

im sure windows security will get better as models get better...

maybe in six months when we have AGI... . . .

Could also be some kind of recall feature.

I just... It's just ridiculous at this point.

However, the scare mongering caused my posts to be soft locked as a security precaution. My posts yesterday received around 3,000 views and no comments. I checked before posting yesterday and there were no similar companies, however, mysteriously today there are several "secure" versions of the same startup I mentioned in the prospectus. (For example https://ontimecall.com/ but there are lots of others, many with long SEO stories that didn't exist yesterday.)

[1] https://taonexus.com/worthless.txt

[2] creative process: https://imgur.com/a/PO7pvCQ

My take is that the addition of CoPilot to MS Paint is probably how this CVE got introduced.

> LLMs are now unfolding technical debt, poorly written code, and security vulnerabilities accumulated in software that they have created themselves.

We seriously need more information.

I'd go out on a limb here perhaps, but I'd claim that if your telemetry means that the one SENDING the data gets a RCE by default by it, you're doing telemetry very wrong. Maybe look into different libraries/services than the ones you use today, please.

1. Telemetry as implemented is usually sloppy. Even though intuitively one could think that telemetry means “data gets collected locally and fired off to a remote server”, we have seen time and time again that they also build a return path to make the telemetry gathering more powerful. That return path can be a vector.

2. Web browsers have a _huge_ surface and they connect to remote servers constantly. The industry does very well at being proactive and at addressing CVEs but the whole premise makes that very difficult and so we cannot absolutely claim that browsers don’t have RCE(s).

I'm claiming if "everything else" does indeed lead to a RCE, you're again doing something very wrong here. It's not rocket science exactly.

To stack assumptions, I'd reach for something like using the recent certificate circus to present as there being an updated version of whatever model it uses on the PCs that can run it locally to give it a fucked up model that does the out of bounds shit as part of whatever verification/checks it does after its downloaded/installed.

It's quite common with vulnerabilities found by IA, there might be less hallucination, but the impact/score is often completely wrong.

"No User Interaction"

Does that mean that paint doesnt have to be running?

Application being installed on a PC allows a specially crafted packet to arbitrarily execute code?

0. My gut says this is somehow related to indexing/thumbnail rendering. But maybe I'm off base.

1. The 'no user interaction' could be related to (ironically) some background pre-indexing process that windows is doing on files inserted to folders.

1.1. LOL maybe their bullshit 'Windows Copilot' which is why the description is so vague, don't want to torpedo things worse than they already are.

2. It could also be, still in the category of 'well, ok they click on a share folder and the preview runs' or a weird edge thing.

2.1. But they aren't being that clear yet, probably because it's bad.

States:

Attack Vector: Network

The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet.

The way I read it is MSPaint is now running as a service and listens to a port (while running? all the time?). Wh?.. Ho?... I can't even...

This is absurd.

Each time I learn something new about Microslop, I'm just glad I'm not a tenant.