There's no remote code execution vulnerability in Paint. What was going on is that yesterday I put together a prospectus for a $20 stock offering[1] and as part of this I used paint while I created ascii art for the prospectus[2]. A defense contractor is scare mongering that this is somehow a remote code execution vulnerability, probably to sell defense services. As you can see, the cve doesn't contain any actual vulnerability. Paint doesn't have any network code at all. Nor buffer overflows. It's very simple bitmap graphics and was carefully tested. It's a 917 kb binary that has been static tested for 20 years.

However, the scare mongering caused my posts to be soft locked as a security precaution. My posts yesterday received around 3,000 views and no comments. I checked before posting yesterday and there were no similar companies, however, mysteriously today there are several "secure" versions of the same startup I mentioned in the prospectus. (For example https://ontimecall.com/ but there are lots of others, many with long SEO stories that didn't exist yesterday.)

[1] https://taonexus.com/worthless.txt

[2] creative process: https://imgur.com/a/PO7pvCQ