MS Paint Remote Code Execution Vulnerability

Re:MS Paint Remote Code Execution Vulnerability by 6thbit on Thursday November 05, 2026 @06:43PM (#50386203)

I wonder if it could be through a file:// or some deeplink custom url handler that opens in Paint and clicking on it with some carefully crafted file path could make it read out of bounds (since that's the associated weakness reported) and execute something.

[ Parent | on HN ]

Re:MS Paint Remote Code Execution Vulnerability by jdiff on Thursday November 05, 2026 @06:48PM (#50386248)

Whatever it is, it doesn't require any clicking or user interaction. Maybe my imagination is just limited but I can't imagine why Paint is making itself available for incoming traffic on the network.

[ Parent | on HN ]

Re:MS Paint Remote Code Execution Vulnerability by 6thbit on Thursday November 05, 2026 @07:05PM (#50386378)

Ah, no interaction. Yikes, doesn't make sense Paint would have a server tho.

Should be easy to verify for someone with a windows machine if it does.

[ Parent | on HN ]

Re:MS Paint Remote Code Execution Vulnerability by jdiff on Thursday November 05, 2026 @10:54PM (#50387954)

Mine doesn't have a mouse or keyboard at the moment, so I'm only checking over an SSH->WSL connection. But it sure doesn't look like it's opening any ports from here.

So I guess either some random OS component is listening to the network and just-as-inexplicably asking Paint to do something for it. Or one of Paint's outbound connections is vulnerable if hijacked by a mitm. Network interception's one of the examples used for the "High" Attack Complexity rating that MS gave this CVE. Maybe powered by eMudhra for any systems that haven't revoked those certs? That'd be topical.

[ Parent | on HN ]