Hacker News
points by sharpshadow 1 day ago | 0 comments
Paint’s image decoding engine is a shared system component and during thumbnail and visual preview generation it gets called automatically without opening the GUI. Ergo it’s enough for a malformed image file to exist on your device to get pwnd.
[–] jasomill 1 day ago
Do you have details on this? Given that this is classified as a network vulnerability of the Paint application itself rather than any shared system components, I assumed it had to do with the recently-introduced Copilot features which AFAIK are the only part of the application that directly interact with the network.
[–] bushbaba 1 day ago
Feels like this was placed on purpose
Hacker News