Hacker News new | past | comments | ask | show | jobs | submit

MS Paint Remote Code Execution Vulnerability

https://www.cve.org/CVERecord?id=CVE-2026-83844
664kuberwastaken | | 249 | HN
pasteleft | parent | next
Paint can exectue arbitrary code from the REMOTE, without USER INTERACTION?????

We seriously need more information.

loading story #50393454
loading story #50388847
monster_truck | parent | next
If I had to guess, without diffing old/new, it's probably related to the generative erase/ai shit.

To stack assumptions, I'd reach for something like using the recent certificate circus to present as there being an updated version of whatever model it uses on the PCs that can run it locally to give it a fucked up model that does the out of bounds shit as part of whatever verification/checks it does after its downloaded/installed.

loading story #50391396
loading story #50393422
loading story #50390038
Oarch | parent | next
I can't wait for the Raymond Chen write up one day.
loading story #50388655
loading story #50386661
loading story #50389068
greyhound1 | parent | next
Had to go to Microsoft Store to get the fixed version, Windows Update didn't show anything.
loading story #50387351
loading story #50386567
loading story #50388451
loading story #50385771
loading story #50386322
loading story #50386737
everylostbit | parent | next
This seems to affect only paint 11.0.0.0 up to, but not including, 11.2605.91.0. For folks like me, running a much older version, its probably safe, although its Windows so, I'm not too sure.
loading story #50386362
loading story #50386201
loading story #50386971
loading story #50392976
xlayn | parent | next
WHY ON HELL paint has a remote code execution in the name of God? WHY? is this because someone who needs to build a CV decided to network something on ..... I can't come with a reason why "An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network." will cause paint to start being nice to an attacker and leaking crypto secrets etc.. the thing says sending a specially crafted packet.. this means windows is part of the attack vector, but that just makes the WHY bigger, really, why?
loading story #50387002
loading story #50386973
loading story #50388992
loading story #50387217
loading story #50386782
loading story #50386695
loading story #50388022
what_hn | parent | next
Paint opens a port?
loading story #50387034
ajasmin | parent | next
What Network?
loading story #50385216
layer8 | parent | next
Fixed in version 11.2609.401.0.
dmitrygr | parent | next
Oh, this is the modern "paint" trash, not mspaint.exe that i still use, copied out of x64 XP build, together with calc.exe
loading story #50386237
loading story #50386686
protocolture | parent | next
Hold up.

"No User Interaction"

Does that mean that paint doesnt have to be running?

Application being installed on a PC allows a specially crafted packet to arbitrarily execute code?

loading story #50387679
patrick_rtk | parent | next
wow thoses days are amazing. cve: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

UI:N it is with no interaction ?

is it a cve mistake ?

loading story #50386067
TZubiri | parent | next
>Exploit Code Maturity

>Unproven

>Remediation Level

>Official Fix

>Report Confidence

>Confirmed

I really like these secondary scoring factors, not just scoring the vuln itself, but how it's being attacked.

sreekanth850 | parent | next
LLMs are now unfolding decades of technical debt, poorly written code, and security vulnerabilities accumulated in software built by humans.
loading story #50387626
loading story #50388670
loading story #50388816
darepublic | parent | next
Is this old or new paint
loading story #50387543
paulpauper | parent | next
is this as bad as Windows Metafile (WMF) Exploit?
loading story #50386846
loading story #50394114
| parent | next
{"dead":true,"deleted":true,"id":50386822,"parent":50384233,"time":1793926732,"type":"comment"}
falcor84 | parent | next
Wow! At first sight I was sure it was a joke, but no. What a time...

https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...

loading story #50384456
dist-epoch | parent | next
This site doesn't do jokes
loading story #50386575
loading story #50386579
loading story #50385544
loading story #50384714
loading story #50384885
Matumio | parent | next
Tangential, but: "We're sorry but the CVE Website doesn't work properly without JavaScript enabled."

Usually I just enable JS. But is this a security site, asking for remote code execution on my device? Before they can show me some text? They just disqualified themselves.

6thbit | parent | next
I'm just in full denial that paint runs a server. Happy to be corrected if someone has a windows machine handy to verify.

But From [0]: > A total of 59 of the October CVEs fit my definition of wormable. Specifically, 57 contain both “An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network” and “No authentication or user interaction is required.”

Makes you wonder if MS is just copy-pasting boilerplate on CVEs and disclosed incorrectly the scope of the one in Paint because they had 56 other bugs to disclose.

So I'm not discounting reporting human error here, yet.

[0] https://www.zerodayinitiative.com/blog/2026/10/13/the-octobe...

tosti | parent | next
Code execution, sure, paint has been used to write executable code too, so why not.

But remote? How

loading story #50384544
loading story #50384542
loading story #50386203
loading story #50384763
loading story #50384897
drillsteps5 | parent | next
https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...

States:

> Attack Vector: Network

> The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet.

The way I read it is MSPaint is now running as a service and listens to a port (while running? all the time?) and you can trigger remote execute by sending data. Just.. Why?..

IFC_LLC | parent | next
At this point I want to declare that air-gapped network with the transfer only over USB drives is a viable and valuable method of handling IT security. Outside transfer only happens by people manually copying text onto a floppy and reading it from a floppy.

I just... It's just ridiculous at this point.

loading story #50388950
itopaloglu83 | parent | next
First the notepad CVE and now this, Microsoft is on a roll.
caust1c | parent | next
Looking forward to the CALC.EXE RCE next, so we can pop calc while we pop calc!
loading story #50385455
pmkary | parent | next
I love Microsoft! Who else might look at a fully offline drawing app and think: "Man this needs the most severe level of networking access capable of remote code execution", and that surely is to put their useless Copilot to absolutely nowhere. Next headline will be "All user credentials stolen from Notepad"
xg15 | parent | next
Waiting for the 0day RCE in Solitaire next...
loading story #50385913
JeppyG | parent | next
What's next, the space cadet pinball game lol... although jokes on them, I would only play it if I didn't have internet.
loading story #50393393
loading story #50389397
loading story #50393146
hmartin | parent | next
The calendar app and my internal clock disagree, is it April 1 today or no?
loading story #50389767
loading story #50390251
reader9274 | parent | next
Finally my childhood abstract Paint art can take over a server
durmusk | parent | next
Does this effect the regular Win32 Paint? Who uses the app store crap anyway?
AlienRobot | parent | next
I miss when MS Paint just opened image files and let you do some basic editing, before layers, background removal and RCE's...
arm32 | parent | next
Patch your MS Paint, everybody!
loading story #50385929
loading story #50391727
tonyhart7 | parent | next
Yep, AI gonna end all software and we come back to air gapped system
kittikitti | parent | next
If ain't broke don't fix it! Why did they change MS Paint! The campy memes will never be the same.
loading story #50387305
| parent | next
{"deleted":true,"id":50385898,"parent":50384233,"time":1793920411,"type":"comment"}
egeozcan | parent | next
I guess it's time to finally bite the bullet and migrate to jspaint.

This is absurd.

loading story #50391858
rarisma | parent
rce in paint i guess bro