Hacker News

While I understand your phrasing getting downvoted, I agree with what I assume you mean:

1. Telemetry as implemented is usually sloppy. Even though intuitively one could think that telemetry means “data gets collected locally and fired off to a remote server”, we have seen time and time again that they also build a return path to make the telemetry gathering more powerful. That return path can be a vector.

2. Web browsers have a _huge_ surface and they connect to remote servers constantly. The industry does very well at being proactive and at addressing CVEs but the whole premise makes that very difficult and so we cannot absolutely claim that browsers don’t have RCE(s).

How?

But only these 2, only software with telemetry and web browsers. There are no RCEs in anything else…

> Every program which has telemetry can

I'd go out on a limb here perhaps, but I'd claim that if your telemetry means that the one SENDING the data gets a RCE by default by it, you're doing telemetry very wrong. Maybe look into different libraries/services than the ones you use today, please.

Citation required for extraordinary claim.

Before MS, there was a time where it wasn’t possible to get a virus by receiving an email. Users had to click on the attachment. Email itself is a text protocol after all.

Then they added automatic HTML parsing of incoming emails, and the attackers cheered.

Some years ago, I ended up on a call with a support team guy, helping him under some parts of a system I worked on. He shared his screen, started drawing diagrams. It took me a whole 10 minutes to realise it was in paint, he was just that good at using it.

Turns out paint was the thing almost every customer had installed/had access to, so he worked to the lowest common denominator and got really good at using it. I guess now he'll need to find a new tool to astonish devs with.

86-ing?

They supposedly did, that is why most stuff on Azure is now a mix of Java, C#, Go and Rust with very little C and C++.

And there is the SFI program.

However this is a Windows application, and in spite some Rust advances in WinDev, it is pretty much C and C++ turf, with Rust getting the same warm reception as .NET used to enjoy.

Guess which language is Paint written on?

Nonetheless, they are doubling down on sandboxing Windows, macOS, iOS and Android style, for quite some time, exactly to become security first as you are asking for.

Remember Windows Vista? Cancel or Allow?

or block ms paint aswell.

why get package after something that is obviously a malicious backdoor?

If I still mamaged any windows host, i would be deploying a remove-package script asap to the entire fleet.

They kinda did.

For some reason, I had the same idea.

You made a slip. Thats Apple you are talking about, and it actually happens.

If brick and mortar Apple stores are staffed by "Geniuses"...

They've added a lot of features and it's almost like Photoshop Elements now. It has layers, general photo editing tools, an AI generator, etc.

It's the last two digits of the year plus the month number. That was June 2026. It was 2504 in May 2025, and 2402 in March 2024.

The Windows 11 version is a complete rewrite.

it seems to be the same version/build as the whole system

You can't have finished software any more. It's now illegal or something. Must keep changing things forever. And must add some AI features of course, to make the VCs happy.

They added AI.

Ads, subscriptions, AI

Did you noticed the round buttons lately ?

yes that is my exact situation. I think (hope?) Microsoft would've disclosed it if prior versions were affected too, although I never heard the "old" paint have anything to do with network, so there's that.

That is Windows version. But you probably use the regular Win32 Paint, so should be okay.

> I don't know if I'm vulnerable or not

Are you using Windows? If so, then yes.

Put it on a file share and now any file is "remote".

unlikely

IFF there is a NSA backdoor it likely would be:

- not in paint, but something you can't disable/remove in hardened special purpose windows setups

- not be easily usable by 3rd parties, like some auth accidentally accepting some quite specific other password (e.g. due to some bug reading the expected hash from the wrong place) or similar

lets not forget as much as the NSA might want to spy on you they also want to keep China/Russia out of spying on US companies. A traditional RCE in paint is very counter productive for that.

I believe they're already quite happy with the Windows OS itself for this purpose, and probably some other firmware-level rootkits across many products like Intel and Qualcomm chipsets. Their contracts with Meta might be helpful too.

Et tu, Paint?

AGI will realize that creating critical exploit vectors only to discover and fix them later will only make it seem more relevant and important.

Not sure what you think is "hilariously cagey", but why would they only be "cagey" if the bug was from ai-features? Also it says paint versions are "affected from 11.0.0.0 before 11.2605.91.0" which I take to mean the bug has been there since Windows 11 was released in 2021

MSRC[1] says otherwise:

> An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

[1] https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...

metapad.exe[0] by liquidninja is a much better notepad replacement IMO. Obviously I am excluding the heavyweight options like Notepad++, Sublime, etc.

[0]: https://liquidninja.com/metapad/download.html

Didn't notepad get a CVE recently too?

The vulnerability predates Copilot. Paint's first vulnerable version (11.0) was released September 2021, Copilot in February 2023.

That looks like a placeholder text they drop in the FAQ for anything tagged as RCE.

Until somebody connects the dots on how the heck MS Paint is accessible over the network, I'm gonna maintain some pretty intense skepticism here.

> https://share.google/aDP2ac9j5AmB13QRo

I understand your frustration.

From the moment I understood the vulnerability of my human flesh it disgusted me.

The CVE was introduced over a year before that.

this is just one case.

Exactly. So the original quote should be updated to read:

> LLMs are now unfolding technical debt, poorly written code, and security vulnerabilities accumulated in software that they have created themselves.

It might not be paint with internet, it might be something like a packet over your network asking a computer to open an input/file, and the computer responds by opening that malicious input with paint

hardened paint, when you lend a security researcher your paint.

I don't think so:

> User Interaction: None

> Out-of-bounds read in Windows Paint allows an unauthorized attacker to execute code over a network.

At least not about serious security matters

This site absolutely does jokes, it just doesn't beat horses into bloody pulps with the jokes the way reddit does. We have a higher standard. A joke has to actually be funny, and not some tired reference.

Except for the infamous Dropbox comment.

Not to imply any particular comparison to less serious websites where the karma system over time may have resulted in a disproportionate surplus of one liner jokes and other spammy low quality posts.

Does windows even have minesweeper anymore

Turns out we were sweeping for CVEs, not mines, all along

It mentions that it may rely on other services or security measures running- I wonder if there’s something like this hitting a firewall or av and then that calling out to paint to check file type or size out something like that?

It still makes it sound like the problem really is the other service that is letting a remote connection invoke some part of MS paint.

Sounds like they just mean opening a file that you got from somewhere else.

>The CVSS score of 8.1 marks this as a high‑severity RCE. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is remote: an attacker can deliver the malicious file over a network connection, for example via Remote Desktop, file shares, or other network‑exposed services that allow users to open images. The lack of EPSS data does not diminish the threat posed by a known RCE, but it does make precise likelihood estimation difficult.

https://app.opencve.io/cve/CVE-2026-83844

The direct implication is that current generations of ms paint are a “service over the network.” Probably a theoretically possible RPC end point of svchost.exe

If they know what you paint/edit, they can sell you ads better

These days paint has copilot...

Whatever it is, it doesn't require any clicking or user interaction. Maybe my imagination is just limited but I can't imagine why Paint is making itself available for incoming traffic on the network.

Sending a BMP file that the user has to open doesn't match what little published details we have:

> The vulnerable system can be exploited without any interaction from any user.

The results will be explosive.

I sooo want to wrangle in a joke about minesweeper being coNP-complete, somehow

Well this is Microsoft Windows so... argyle?