MS Paint Remote Code Execution Vulnerability

falcor84

Wow! At first sight I was sure it was a joke, but no. What a time... https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...

tosti

Code execution, sure, paint has been used to write executable code too, so why not. But remote ? How

layer8

Fixed in version 11.2609.401.0.

TZubiri

>Exploit Code Maturity >Unproven >Remediation Level >Official Fix >Report Confidence >Confirmed I really like these secondary scoring factors, not just scoring the vuln itself, but how it's being attacked.

arm32

Patch your MS Paint, everybody!

rarisma

rce in paint i guess bro

ajasmin

What Network?

Oarch

I can't wait for the Raymond Chen write up one day.

mmargenot

no my beloved

itopaloglu83

First the notepad CVE and now this, Microsoft is on a roll.

everylostbit

This seems to affect only paint 11.0.0.0 up to, but not including, 11.2605.91.0. For folks like me, running a much older version, its probably safe, although its Windows so, I'm not too sure.

caust1c

Looking forward to the CALC.EXE RCE next, so we can pop calc while we pop calc!

patrick_rtk

wow thoses days are amazing. cve: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H UI:N it is with no interaction ? is it a cve mistake ?

greyhound1

Had to go to Microsoft Store to get the fixed version, Windows Update didn't show anything.

xg15

Waiting for the 0day RCE in Solitaire next...

NooneAtAll5

neighbouring post: https://news.ycombinator.com/item?id=50383612

paulpauper

is this as bad as Windows Metafile (WMF) Exploit?

dmitrygr

Oh, this is the modern "paint" trash, not mspaint.exe that i still use, copied out of x64 XP build, together with calc.exe

what_hn

Paint opens a port?

AlienRobot

I miss when MS Paint just opened image files and let you do some basic editing, before layers, background removal and RCE's...