Microsoft Warns of Windows Paint Flaw Enabling code to be run remotely

What the advisory describes

According to Microsoft's security advisory, the weakness is an out-of-bounds read, classified as CWE-125. Such a flaw arises when software reads memory that lies outside the region it was meant to access. Errors of this kind can expose sensitive memory, crash applications, or assist attackers in getting around protections when combined with other techniques.

Microsoft says an attacker could take advantage of the flaw by transmitting a specially built packet to an affected service across the network. The advisory does not name that service, the network port involved, or a detailed chain of execution, so several implementation details remain undisclosed.

Severity and exploitation conditions

The vulnerability has a CVSS 3.1 base score of 8.1, a figure that points to potentially serious consequences. Its vector describes network reachability, high attack complexity, no required privileges and no need for user interaction. Microsoft notes that exploiting the flaw demands deep knowledge of the system and depends on environmental conditions, configuration and additional security measures.

The impacts on confidentiality, integrity and availability are each rated high, while the security scope remains unchanged.

Context and fix

The disclosure comes after earlier vulnerabilities in Windows graphics components, although those involved different parts of the system and different attack methods. Microsoft's current advisory identifies Paint build 11.2609.401.0 as the security update.

Open questions

• Which service and network port does the crafted packet target?
• How hard is a working exploit to build in practice, given the high attack complexity rating?