News for hackers. Stuff that matters.
Re:MS Paint Remote Code Execution Vulnerability by hoppp on Thursday November 05, 2026 @05:12PM (#50385216)
It's probably a way to get phished, if you click on a malicious bmp file.
Re:MS Paint Remote Code Execution Vulnerability by Arainach on Thursday November 05, 2026 @06:15PM (#50385917)
MSRC[1] says otherwise:

> An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

[1] https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...

Re:MS Paint Remote Code Execution Vulnerability by hoppp on Friday November 06, 2026 @07:51AM (#50391734)
I don't know anyone running Paint servers and I'm pretty sure phishing could be possible.
Re:MS Paint Remote Code Execution Vulnerability by Arainach on Friday November 06, 2026 @12:38PM (#50395571)
It's bizarre that you're doubling down in the face of statements from Microsoft's security experts who have the full context of the investigation and the source code. It's worth some self-reflection on what drove you to make this post.
Re:MS Paint Remote Code Execution Vulnerability by hoppp on Friday November 06, 2026 @01:32PM (#50396333)
Where does it say that you can't be phished with a bmp file?
Re:MS Paint Remote Code Execution Vulnerability by Arainach on Friday November 06, 2026 @02:20PM (#50397034)
It says that "no user interaction is required", so phishing is explicitly not what this vulnerability is about.

You haven't declared any privileged knowledge of this attack or MS Paint and have, on vibes, doubled down on what you assume must be going on despite other evidence.

It's a bad look.

Re:MS Paint Remote Code Execution Vulnerability by hoppp on Friday November 06, 2026 @02:40PM (#50397313)
Look away then anything else is pointless.

You don't have to comment on other people's comments you know.

Re:MS Paint Remote Code Execution Vulnerability by Arainach on Friday November 06, 2026 @05:38PM (#50399446)
> Maybe you should self-reflect on why you are offended by my comment

A significant chunk of the world's problems today are caused by or exacerbated by people who confidently assert things they believe regardless of what evidence or experts say, and who dismiss expertise. Those people are emboldened by others allowing them to spew nonsense unchecked, and I have no interest in seeing HN degraded similarly.

You're moving goalposts. A commenter asked what Networking MS Paint had in the context of this vulnerability. You made an assertion not supported by the documentation we had, and now you're trying to claim that there could be other vulnerabilities rather than admitting that you made a mistake without doing any research.

Re:MS Paint Remote Code Execution Vulnerability by hoppp on Friday November 06, 2026 @06:32PM (#50399954)
Arguing on the internet over these kind of things is not a very good look.
Re:MS Paint Remote Code Execution Vulnerability by decidu0us9034 on Friday November 06, 2026 @01:39PM (#50396445)
The boilerplate FAQ text is frequently wrong or incomplete. You can go through the catalog and look through some of them and see how many have multiple revisions. I think, if you want to know definitively, you have to patch diff it