News for hackers. Stuff that matters.

A comment on MS Paint Remote Code Execution Vulnerability. Parent comment

[dead]
Re:MS Paint Remote Code Execution Vulnerability by autoexec on Thursday November 05, 2026 @05:21PM (#50385321)
Sounds like it might be opening a file that was sent over the network without any user interaction.
[ Parent | on HN ]
Re:MS Paint Remote Code Execution Vulnerability by advisedwang on Thursday November 05, 2026 @05:26PM (#50385372)
That's... that's not RCE though.
[ Parent | on HN ]
Re:MS Paint Remote Code Execution Vulnerability by decidu0us9034 on Friday November 06, 2026 @01:54PM (#50396671)
Yes, it is.
[ Parent | on HN ]
Re:MS Paint Remote Code Execution Vulnerability by eqvinox on Thursday November 05, 2026 @05:28PM (#50385403)
Reading tea leaves is still reading tea leaves, even if you make an AI do it… (which is what this is, judging by other things I've seen on opencve.io)
[ Parent | on HN ]
Re:MS Paint Remote Code Execution Vulnerability by jdiff on Thursday November 05, 2026 @07:51PM (#50386758)
Yeah, OpenCVE also includes this:

> After applying the update, verify that the target Windows systems are running a version that includes the CVE fix before disabling legacy file‑open processing in Paint.

Which is complete nonsense. "Legacy file-open processing" isn't a real configurable option in Paint and this seems to suggest that enabling it is some sort of mitigation. The resolution is simply to update Paint.

[ Parent | on HN ]