News for hackers. Stuff that matters.

A comment on MS Paint Remote Code Execution Vulnerability. Parent comment

Re:MS Paint Remote Code Execution Vulnerability by sharpshadow on Friday November 06, 2026 @10:24AM (#50393454)
Paint’s image decoding engine is a shared system component and during thumbnail and visual preview generation it gets called automatically without opening the GUI. Ergo it’s enough for a malformed image file to exist on your device to get pwnd.
[ Parent | on HN ]
Re:MS Paint Remote Code Execution Vulnerability by bushbaba on Friday November 06, 2026 @11:28AM (#50394526)
Feels like this was placed on purpose
[ Parent | on HN ]
Re:MS Paint Remote Code Execution Vulnerability by jasomill on Friday November 06, 2026 @03:43PM (#50398241)
Do you have details on this? Given that this is classified as a network vulnerability of the Paint application itself rather than any shared system components, I assumed it had to do with the recently-introduced Copilot features which AFAIK are the only part of the application that directly interact with the network.
[ Parent | on HN ]