Nov 9, 2026, 8:01 AM@hacks4pancakes Honestly, I'm more enraged about the recent MS Paint issue with Paint being exploitable zero-click over network rather than OT connected to the Internet. Yes, the latter has terrible impact, but as you said... there are reasons (despite most of them not being purely technical but "just" monetary/staffing). Unlike with Paint.
@ljrk @hacks4pancakes
What was the paint exploit in the end? The report wasn't super specific and lead me to believe they counted a .bmp on a network share to be what they meant by "over the network"
Nov 9, 2026, 10:41 AM@EndlessMason @hacks4pancakes I mean if the mere existence of the bmp would already result in RCE I'd consider that quite fatal and I doubt MS would've played up that issue, that wouldn't be in their interest. They called it zero click too so I think it's quite severe although I don't know the details. Whatever the case, this kind of vuln should just not exist in Paint, no matter how bad – simply because paint should have this kind of access.
@ljrk @hacks4pancakes
Nearly the whole thing is murky - Is it a packet or a file? Which version has the fix? How do you get the fix? Is this just an ad for an AI vuln fuzzer? How do you get to code execution from an out of bounds read? Who even reported it?
Maybe I'm just not paying the right vuln enrichment group, but the report isn't much more than "CWE-125 out of bounds read, mspaint.exe, CVSS 7.0"
Nov 10, 2026, 5:41 PM@EndlessMason @hacks4pancakes Oh absolutely! I just think, given MS' response history, that they'd take every opportunity to downrate the vuln. So while I'm weary about all that CVE marketing bs r/n, if MS is, themselves, saying that this is *bad* then I tend to believe them ^^'
@ljrk @hacks4pancakes
Yeah! They say it's "bad but hard to reproduce", which seems like both of those things at once