MSRC[1] says otherwise:
reply> An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.
[1] https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...
I don't know anyone running Paint servers and I'm pretty sure phishing could be possible.
replyIt's bizarre that you're doubling down in the face of statements from Microsoft's security experts who have the full context of the investigation and the source code. It's worth some self-reflection on what drove you to make this post.
replyThe boilerplate FAQ text is frequently wrong or incomplete. You can go through the catalog and look through some of them and see how many have multiple revisions. I think, if you want to know definitively, you have to patch diff it
replyWhere does it say that you can't be phished with a bmp file?
reply