Paint can exectue arbitrary code from the REMOTE, without USER INTERACTION?????

We seriously need more information.

I can't wait for the Raymond Chen write up one day.

Had to go to Microsoft Store to get the fixed version, Windows Update didn't show anything.

This seems to affect only paint 11.0.0.0 up to, but not including, 11.2605.91.0. For folks like me, running a much older version, its probably safe, although its Windows so, I'm not too sure.

I hope I can use this to embed a functioning Piet interpreter into Paint so it can execute arbitrary programs that I draw.

WHY ON HELL paint has a remote code execution in the name of God? WHY? is this because someone who needs to build a CV decided to network something on ..... I can't come with a reason why "An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network." will cause paint to start being nice to an attacker and leaking crypto secrets etc.. the thing says sending a specially crafted packet.. this means windows is part of the attack vector, but that just makes the WHY bigger, really, why?

Paint opens a port?

What Network?

Oh, this is the modern "paint" trash, not mspaint.exe that i still use, copied out of x64 XP build, together with calc.exe

Fixed in version 11.2609.401.0.

Hold up.

"No User Interaction"

Does that mean that paint doesnt have to be running?

Application being installed on a PC allows a specially crafted packet to arbitrarily execute code?

neighbouring post: https://news.ycombinator.com/item?id=50383612

wow thoses days are amazing. cve: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

UI:N it is with no interaction ?

is it a cve mistake ?

reminds me of https://ubuntu.com/security/notices/USN-3246-1

>Exploit Code Maturity

>Unproven

>Remediation Level

>Official Fix

>Report Confidence

>Confirmed

I really like these secondary scoring factors, not just scoring the vuln itself, but how it's being attacked.

LLMs are now unfolding decades of technical debt, poorly written code, and security vulnerabilities accumulated in software built by humans.

Of course.

Is this old or new paint

is this as bad as Windows Metafile (WMF) Exploit?

Wow! At first sight I was sure it was a joke, but no. What a time...

https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...

Tangential, but: "We're sorry but the CVE Website doesn't work properly without JavaScript enabled."

Usually I just enable JS. But is this a security site, asking for remote code execution on my device? Before they can show me some text? They just disqualified themselves.

I'm just in full denial that paint runs a server. Happy to be corrected if someone has a windows machine handy to verify.

But From [0]: > A total of 59 of the October CVEs fit my definition of wormable. Specifically, 57 contain both “An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network” and “No authentication or user interaction is required.”

Makes you wonder if MS is just copy-pasting boilerplate on CVEs and disclosed incorrectly the scope of the one in Paint because they had 56 other bugs to disclose.

So I'm not discounting reporting human error here, yet.

[0] https://www.zerodayinitiative.com/blog/2026/10/13/the-octobe...

Code execution, sure, paint has been used to write executable code too, so why not.

But remote? How

https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...

States:

> Attack Vector: Network

> The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet.

The way I read it is MSPaint is now running as a service and listens to a port (while running? all the time?) and you can trigger remote execute by sending data. Just.. Why?..

At this point I want to declare that air-gapped network with the transfer only over USB drives is a viable and valuable method of handling IT security. Outside transfer only happens by people manually copying text onto a floppy and reading it from a floppy.

I just... It's just ridiculous at this point.

why does PAINT of all apps need to do something with the network? telemetry? AI? both?

First the notepad CVE and now this, Microsoft is on a roll.

Looking forward to the CALC.EXE RCE next, so we can pop calc while we pop calc!

I love Microsoft! Who else might look at a fully offline drawing app and think: "Man this needs the most severe level of networking access capable of remote code execution", and that surely is to put their useless Copilot to absolutely nowhere. Next headline will be "All user credentials stolen from Notepad"

Waiting for the 0day RCE in Solitaire next...

What's next, the space cadet pinball game lol... although jokes on them, I would only play it if I didn't have internet.

Great, now I have to go and update all my software that depends on MS Paint. There goes my weekend.

Does MS Paint have network connections? This is sick.

Each time I learn something new about Microslop, I'm just glad I'm not a tenant.

The calendar app and my internal clock disagree, is it April 1 today or no?

mspaint, remote code execution vulnerability. Dear gosh nothing is sacred.

Do notepad next, haha

Finally my childhood abstract Paint art can take over a server

Does this effect the regular Win32 Paint? Who uses the app store crap anyway?

Lol. Cue the "not like this" memes.

I miss when MS Paint just opened image files and let you do some basic editing, before layers, background removal and RCE's...

Patch your MS Paint, everybody!

Yep, AI gonna end all software and we come back to air gapped system

If ain't broke don't fix it! Why did they change MS Paint! The campy memes will never be the same.

I guess it's time to finally bite the bullet and migrate to jspaint.

This is absurd.

Thy F'd up again! Wish I had a tracker for all of microsoft's mistakes... oh wait, I already made one! haha