Yeah, sorry. That was when the first LTS was delayed by 2 months. I don't recall that ever happening again these past 2 decades.

The good thing was a LOT of bugs were fixed in those 2 months. Also you can install or upgrade to U+1, so you could've upgraded in april.

   potential buyers are discussing about a $1.2 trillion to $1.3 trillion valuation range for the company, according to people familiar with the matter. Some are weighing a value as low as $1.1 trillion

These people are from another planet.

Code execution, sure, paint has been used to write executable code too, so why not.

But remote? How

"An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.."

Still, the question remains... How?

It mentions that it may rely on other services or security measures running- I wonder if there’s something like this hitting a firewall or av and then that calling out to paint to check file type or size out something like that?

It still makes it sound like the problem really is the other service that is letting a remote connection invoke some part of MS paint.

But why MS Paint? What functionality does it offer to another program to get called on specifically? And if this other service isn't calling on it specifically, what else can it be tricked into calling? And how many of those are also vulnerable to being stabbed in the back? The smaller interior holes are a problem, sure, but it seems like the CVE should be for the hull hole in that case.

Sounds like they just mean opening a file that you got from somewhere else.

>The CVSS score of 8.1 marks this as a high‑severity RCE. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is remote: an attacker can deliver the malicious file over a network connection, for example via Remote Desktop, file shares, or other network‑exposed services that allow users to open images. The lack of EPSS data does not diminish the threat posed by a known RCE, but it does make precise likelihood estimation difficult.

https://app.opencve.io/cve/CVE-2026-83844

That's... that's not RCE though.

Yes, it is.

Sounds like it might be automatically opening a file that was sent over the network without any user interaction.

Reading tea leaves is still reading tea leaves, even if you make an AI do it… (which is what this is, judging by other things I've seen on opencve.io)

Yeah, OpenCVE also includes this:

> After applying the update, verify that the target Windows systems are running a version that includes the CVE fix before disabling legacy file‑open processing in Paint.

Which is complete nonsense. "Legacy file-open processing" isn't a real configurable option in Paint and this seems to suggest that enabling it is some sort of mitigation. The resolution is simply to update Paint.

The direct implication is that current generations of ms paint are a “service over the network.” Probably a theoretically possible RPC end point of svchost.exe

I'm thankfully out of the loop on Windows these days, but as I remember it Paint did not have any network features? Is that still true? If if is, maybe it is a misfiling of the CVE and it isn't remote?

Or are they chaining a browser auto opening a download in paint, (but browsers shouldn't do that)...

If they know what you paint/edit, they can sell you ads better

These days paint has copilot...

Why for the love of everything that is good does MS Paint have network trash in it. It's a super simple bitmap editor. Like Notepad, it's simple and just works.

Make a new product and bundle that as an option if you want to drastically change the functionality.

Hate to break it to you..

> Notepad in Windows includes AI features powered by Copilot that help refine and shorten text with the assistance of GPT. By default, these AI features are enabled on managed devices

https://learn.microsoft.com/en-us/windows/client-management/...

> Like Notepad, it's simple and just works.

I mean… what else were the people working on Notepad and Paint to do!?

The order came down to integrate AI, and they wanted to be promoted.

Every single day I’m happier and happier than I use Linux now.

Some distro will default to integrating an AI into bash any day now. It's only a matter of time till less and vim have AI search.

There are certainly many options to choose from: https://gist.github.com/ColinKennedy/8a0eea1b18b6e22bc10daa6...

I've asked Claude to review top candidates from https://github.com/ColinKennedy/neovim-ai-plugins

Luckily with OSS we can fork it

This is the only network feature paint has iirc, so that's probably it.

It's the only network feature I can think of, but what is it doing opening a port to wait and listen for anything?

I wonder if it could be through a file:// or some deeplink custom url handler that opens in Paint and clicking on it with some carefully crafted file path could make it read out of bounds (since that's the associated weakness reported) and execute something.

Whatever it is, it doesn't require any clicking or user interaction. Maybe my imagination is just limited but I can't imagine why Paint is making itself available for incoming traffic on the network.

Ah, no interaction. Yikes, doesn't make sense Paint would have a server tho.

Should be easy to verify for someone with a windows machine if it does.

Mine doesn't have a mouse or keyboard at the moment, so I'm only checking over an SSH->WSL connection. But it sure doesn't look like it's opening any ports from here.

So I guess either some random OS component is listening to the network and just-as-inexplicably asking Paint to do something for it. Or one of Paint's outbound connections is vulnerable if hijacked by a mitm. Network interception's one of the examples used for the "High" Attack Complexity rating that MS gave this CVE. Maybe powered by eMudhra for any systems that haven't revoked those certs? That'd be topical.

But still wouldn't really make sense. A patch for machines that are actively updating Paint but dodging cert revocations? Nothing really makes sense about this silly Paint CVE.

Maybe because a .bmp file could be sent remotely.

Or maybe after the .bmp file is executed, it can install something that opens an outbound TCP connection to its C2, and thus can receive commands. Would not need admin privileges because it doesn't open a port, just 'outbound' connections, like a long-poll.

Sending a BMP file that the user has to open doesn't match what little published details we have:

> The vulnerable system can be exploited without any interaction from any user.

you are right, it seems like the latter outbouns tcp connection is already being opened by paint, and that is what is exploitable.

since it exposes no port, I’d assume it isn’t trivial to exploit, paint will chose its target (a microsoft domain or IP), the exploit must involve some error in destination selection, or simply allowing a mitm to impersonate microsoft.

this is inline with Attack Complexity High, attacker needs to be either in the network path (mitm) or control the erroneous destination of the connection (say mircosoft.com), possibly blocking (dosing) the higher priority genuine destination

Seems odd even for a vibecoded copilot integration to make repeated, unprompted network requests. And if they're not repeated and unprompted, then we don't meet the "no user input" requirement.

pretty standard to check for updates no?

For others, def. For paint, it's always been either OS-updated or store-updated.

Because the definition of "remote" has been expanded in the name of resume-driven development to include sending a malicious file that a victim has to open.

Cool! Have you also tried setting maximum display size in accessibility settings on android? I lost most of them at the stairs and the rest fell into the walls. Is that supposed to happen? None reached the bottom. That said, this is pretty cool.

That's beautiful! I hope it doesn't measure and chart the patients ^-^

If the jellyfin receives content from anywhere else, a separate job for transcoding would cover those too.

The somehow is package B has the same filename as package A.

Let's get rid of time!

even more extreme slippery slope. you are like the one who say get rid of cars because they kill people.

Let's get rid of time because it kills people.

Time doesn't kill people, people using time kills people.

That's on them, see the first 2 rules.

I like how you got their pronoun correctly

How would you know? They/them is usable in the singular as gender-neutral. I'd appreciate that lack of assumption either way.

I compile software every day. There's nothing difficult about it until cmake starts complaining, but I've got it back on track every time.

Companies who care about whether their FIPS implementation is validated or not would probably prefer buying from a company who sells it over relying on a guy at their company to get cmake back on track regularly. At that point, it's not just about the module, it's about custody, liability, etc.

Jeez laweez. Since when can lawyers make good technical decisions?

I saw a PIN terminal reboot a while ago and the openSSL version was ancient, pretty much historic at that point. But it has an unbroken seal on it, so it's safe, right?

The problem always boils down to money.

It isn't just compiling something that works. You need to compile it exactly as specified. And document the entire process so you can prove to an auditor that you did everything correctly. Oh, and there's a list of tested platforms, and if your platform isn't on there, which Debian probably isn't, you need to explain to the auditor why it's ok, and why it isn't reasonable for you to use one of the platforms it was tested on.

What you are paying for is not saving the time of a developer compiling something. It's reducing the friction when you go through an audit.

I wonder what the specifics of certification are. No certificate can ever prove a given binary works correctly. No one really understands how computers work, but here's a piece of paper that says Oracle Linux 11.0 is okay. It was expensive and it has a seal of approval on it, so that proves it.