Windows Paint

Microsoft discloses unauthenticated remote code execution flaw in Windows Paint

Microsoft◼'s October security release disclosed an out-of-bounds read (CWE-125) in Windows Paint◆ that could allow remote code execution without authentication or user interaction. The attack reportedly uses a specially crafted network packet sent to an affected service, though the advisory does not name that service, and Microsoft rates exploitation as Less Likely with no known exploitation. Administrators should confirm the corrected Paint build is installed on every device rather than assume automatic updates have worked.