News for hackers. Stuff that matters.

A comment on MS Paint Remote Code Execution Vulnerability. Parent comment

Re:MS Paint Remote Code Execution Vulnerability by gruez on Thursday November 05, 2026 @08:26PM (#50387002)
>I can't come with a reason why "An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network."

The Microsoft link doesn't mention this at all, so my guess it's "remote" in the sense that a zip file exploit is "remote"

[ Parent | on HN ]
Re:MS Paint Remote Code Execution Vulnerability by doubled112 on Thursday November 05, 2026 @09:02PM (#50387224)
Put it on a file share and now any file is "remote".
[ Parent | on HN ]
Re:MS Paint Remote Code Execution Vulnerability by jdiff on Thursday November 05, 2026 @10:07PM (#50387672)
Remote, and inapplicable. One of the very few things the Microsoft link does mention that no user interaction is required. A banana left out in the walkway still requires the user to go for a walk.
[ Parent | on HN ]
Re:MS Paint Remote Code Execution Vulnerability by dofm on Friday November 06, 2026 @12:22AM (#50388532)
> A banana left out in the walkway still requires the user to go for a walk.

This is some Eric-Cantona-level gnomic mysticism. I approve.

[ Parent | on HN ]
Re:MS Paint Remote Code Execution Vulnerability by simiones on Friday November 06, 2026 @10:59AM (#50394019)
It absolutely does, in the "FAQ" section:

https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...

> How could an attacker exploit this vulnerability?

> An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required..

[ Parent | on HN ]
Re:MS Paint Remote Code Execution Vulnerability by jasomill on Friday November 06, 2026 @03:47PM (#50398296)
Paint now has Copilot features that require sign-in, so presumably involve network access.
[ Parent | on HN ]