Still, the question remains... How?
>The CVSS score of 8.1 marks this as a high‑severity RCE. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is remote: an attacker can deliver the malicious file over a network connection, for example via Remote Desktop, file shares, or other network‑exposed services that allow users to open images. The lack of EPSS data does not diminish the threat posed by a known RCE, but it does make precise likelihood estimation difficult.
> After applying the update, verify that the target Windows systems are running a version that includes the CVE fix before disabling legacy file‑open processing in Paint.
Which is complete nonsense. "Legacy file-open processing" isn't a real configurable option in Paint and this seems to suggest that enabling it is some sort of mitigation. The resolution is simply to update Paint.
Or are they chaining a browser auto opening a download in paint, (but browsers shouldn't do that)...
Make a new product and bundle that as an option if you want to drastically change the functionality.
> Notepad in Windows includes AI features powered by Copilot that help refine and shorten text with the assistance of GPT. By default, these AI features are enabled on managed devices
https://learn.microsoft.com/en-us/windows/client-management/...
I mean… what else were the people working on Notepad and Paint to do!?
The order came down to integrate AI, and they wanted to be promoted.
Every single day I’m happier and happier than I use Linux now.
Should be easy to verify for someone with a windows machine if it does.
So I guess either some random OS component is listening to the network and just-as-inexplicably asking Paint to do something for it. Or one of Paint's outbound connections is vulnerable if hijacked by a mitm. Network interception's one of the examples used for the "High" Attack Complexity rating that MS gave this CVE. Maybe powered by eMudhra for any systems that haven't revoked those certs? That'd be topical.
But still wouldn't really make sense. A patch for machines that are actively updating Paint but dodging cert revocations? Nothing really makes sense about this silly Paint CVE.
Or maybe after the .bmp file is executed, it can install something that opens an outbound TCP connection to its C2, and thus can receive commands. Would not need admin privileges because it doesn't open a port, just 'outbound' connections, like a long-poll.
> The vulnerable system can be exploited without any interaction from any user.
since it exposes no port, I’d assume it isn’t trivial to exploit, paint will chose its target (a microsoft domain or IP), the exploit must involve some error in destination selection, or simply allowing a mitm to impersonate microsoft.
this is inline with Attack Complexity High, attacker needs to be either in the network path (mitm) or control the erroneous destination of the connection (say mircosoft.com), possibly blocking (dosing) the higher priority genuine destination