Hacker News

points by nonethewiser 2 days ago | 0 comments

Sounds like they just mean opening a file that you got from somewhere else.

>The CVSS score of 8.1 marks this as a high‑severity RCE. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is remote: an attacker can deliver the malicious file over a network connection, for example via Remote Desktop, file shares, or other network‑exposed services that allow users to open images. The lack of EPSS data does not diminish the threat posed by a known RCE, but it does make precise likelihood estimation difficult.

https://app.opencve.io/cve/CVE-2026-83844

[–] advisedwang 2 days ago

That's... that's not RCE though.

[–] decidu0us9034 1 day ago

Yes, it is.

[–] autoexec 2 days ago

Sounds like it might be automatically opening a file that was sent over the network without any user interaction.

[–] eqvinox 2 days ago

Reading tea leaves is still reading tea leaves, even if you make an AI do it… (which is what this is, judging by other things I've seen on opencve.io)

[–] jdiff 2 days ago

Yeah, OpenCVE also includes this:

> After applying the update, verify that the target Windows systems are running a version that includes the CVE fix before disabling legacy file‑open processing in Paint.

Which is complete nonsense. "Legacy file-open processing" isn't a real configurable option in Paint and this seems to suggest that enabling it is some sort of mitigation. The resolution is simply to update Paint.