Paint can exectue arbitrary code from the REMOTE, without USER INTERACTION?????
We seriously need more information.
Oarchyesterday at 10:08 PM
I can't wait for the Raymond Chen write up one day.
greyhound1yesterday at 10:35 PM
Had to go to Microsoft Store to get the fixed version, Windows Update didn't show anything.
everylostbityesterday at 10:20 PM
This seems to affect only paint 11.0.0.0 up to, but not including, 11.2605.91.0.
For folks like me, running a much older version, its probably safe, although its Windows so, I'm not too sure.
sunrunnertoday at 2:48 PM
I hope I can use this to embed a functioning Piet interpreter into Paint so it can execute arbitrary programs that I draw.
xlayntoday at 12:27 AM
WHY ON HELL paint has a remote code execution in the name of God?
WHY? is this because someone who needs to build a CV decided to network something on ..... I can't come with a reason why "An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network." will cause paint to start being nice to an attacker and leaking crypto secrets etc.. the thing says sending a specially crafted packet.. this means windows is part of the attack vector, but that just makes the WHY bigger, really, why?
Tangential, but: "We're sorry but the CVE Website doesn't work properly without JavaScript enabled."
Usually I just enable JS. But is this a security site, asking for remote code execution on my device? Before they can show me some text? They just disqualified themselves.
6thbittoday at 12:12 AM
I'm just in full denial that paint runs a server. Happy to be corrected if someone has a windows machine handy to verify.
But From [0]:
> A total of 59 of the October CVEs fit my definition of wormable. Specifically, 57 contain both “An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network” and “No authentication or user interaction is required.”
Makes you wonder if MS is just copy-pasting boilerplate on CVEs and disclosed incorrectly the scope of the one in Paint because they had 56 other bugs to disclose.
So I'm not discounting reporting human error here, yet.
> The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet.
The way I read it is MSPaint is now running as a service and listens to a port (while running? all the time?) and you can trigger remote execute by sending data. Just.. Why?..
IFC_LLCtoday at 12:52 AM
At this point I want to declare that air-gapped network with the transfer only over USB drives is a viable and valuable method of handling IT security. Outside transfer only happens by people manually copying text onto a floppy and reading it from a floppy.
I just... It's just ridiculous at this point.
itopaloglu83yesterday at 10:18 PM
First the notepad CVE and now this, Microsoft is on a roll.
caust1cyesterday at 10:27 PM
Looking forward to the CALC.EXE RCE next, so we can pop calc while we pop calc!
pmkarytoday at 5:45 AM
I love Microsoft! Who else might look at a fully offline drawing app and think: "Man this needs the most severe level of networking access capable of remote code execution", and that surely is to put their useless Copilot to absolutely nowhere. Next headline will be "All user credentials stolen from Notepad"
xg15yesterday at 10:54 PM
Waiting for the 0day RCE in Solitaire next...
JeppyGtoday at 1:35 AM
What's next, the space cadet pinball game lol... although jokes on them, I would only play it if I didn't have internet.
kleicyntoday at 3:19 PM
why does PAINT of all apps need to do something with the network? telemetry? AI? both?
hotelsachertoday at 7:52 AM
Does MS Paint have network connections? This is sick.
Each time I learn something new about Microslop, I'm just glad I'm not a tenant.
martypitttoday at 3:01 PM
Great, now I have to go and update all my software that depends on MS Paint. There goes my weekend.
hmartintoday at 2:34 AM
The calendar app and my internal clock disagree, is it April 1 today or no?
kar1181today at 8:46 AM
mspaint, remote code execution vulnerability. Dear gosh nothing is sacred.
CrzyLngPwdtoday at 9:41 AM
Do notepad next, haha
reader9274today at 12:24 AM
Finally my childhood abstract Paint art can take over a server
durmusktoday at 5:09 AM
Does this effect the regular Win32 Paint? Who uses the app store crap anyway?
AlienRobottoday at 12:00 AM
I miss when MS Paint just opened image files and let you do some basic editing, before layers, background removal and RCE's...
arm32yesterday at 9:39 PM
Patch your MS Paint, everybody!
whoisthemachinetoday at 12:50 PM
Lol. Cue the "not like this" memes.
tonyhart7today at 5:01 AM
Yep, AI gonna end all software and we come back to air gapped system
kittikittitoday at 1:58 AM
If ain't broke don't fix it! Why did they change MS Paint! The campy memes will never be the same.
deletedyesterday at 11:13 PM
egeozcantoday at 6:11 AM
I guess it's time to finally bite the bullet and migrate to jspaint.
This is absurd.
kitkarltoday at 1:05 PM
Thy F'd up again! Wish I had a tracker for all of microsoft's mistakes... oh wait, I already made one! haha