"An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.."
It mentions that it may rely on other services or security measures running- I wonder if there’s something like this hitting a firewall or av and then that calling out to paint to check file type or size out something like that?
But why MS Paint? What functionality does it offer to another program to get called on specifically? And if this other service isn't calling on it specifically, what else can it be tricked into calling? And how many of those are also vulnerable to being stabbed in the back? The smaller interior holes are a problem, sure, but it seems like the CVE should be for the hull hole in that case.
Sounds like they just mean opening a file that you got from somewhere else.
>The CVSS score of 8.1 marks this as a high‑severity RCE. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is remote: an attacker can deliver the malicious file over a network connection, for example via Remote Desktop, file shares, or other network‑exposed services that allow users to open images. The lack of EPSS data does not diminish the threat posed by a known RCE, but it does make precise likelihood estimation difficult.
> After applying the update, verify that the target Windows systems are running a version that includes the CVE fix before disabling legacy file‑open processing in Paint.
Which is complete nonsense. "Legacy file-open processing" isn't a real configurable option in Paint and this seems to suggest that enabling it is some sort of mitigation. The resolution is simply to update Paint.
The direct implication is that current generations of ms paint are a “service over the network.” Probably a theoretically possible RPC end point of svchost.exe
wire fraud, credit card fraud, pig butchering (a different way to access the accounts really), etc.. The traditional system do have some safeties but it's not impenetrable.
I must have been part of an experiment group because a month or so ago login started becoming required to keep browsing Reddit after something like clicking on the third post. It was a wonderful thing that dramatically cut my reddit usage. Then it went away. Looking forward for them to roll it out again.
Funny, for me it's the opposite: I get extremely irritated when Musk or someone else says the future of humanity is to colonize Mars. If you think you can turn a bare rock into a livable planet, please do something about Earth and global warming first.
It comes up every so often. If you're actually putting in enough effort to make a proper colony, and not e.g. McMurdo Station but colder and redder and the air's unbreathable even in summer and the soil's poison, then an artificial magnetosphere is not a huge additional cost.
It's way beyond what we can do right now, but then again, at time of writing Starship has yet to have been in a circular orbit, so all aspects of a Mars colony are way beyond what we can do right now.
Terraforming a planet is equal to EVs? Reversing, not just slowing, anthropogenic climate change needs a bit more than a green transition. And if you think Mars as is constitutes humanities future, spend a year at the South Pole. Without terraforming, it’ll be that, but far worse. If we can make that rock half way survivable, not even properly habitable, we’ll see those techniques applied closer to home long before.
He made an electric car the into the best selling car in the world, and is building the largest solar cell factory in the US. What more should he personally be doing about global warming?
No, Martin Eberhard and Marc Tarpenning did not make the Model Y. They left the company more than a decade before. Neither did they make the Model 3, nor the Model S before that. They didn't even make it to the first delivery of Tesla's first car, the Roadster. Your implication that they deserve credit for two decades' worth of Tesla's achievements after they left is plainly ridiculous.
LOL this comes up every single time. Tesla was nothing, it was a name and a plan. They had absolutely 0 and statistically would have never done anything.
Ya'll need to stop with what the founders accomplished pre-Musk.
I have never owned, nor have any desire to ever own a Tesla or any electric car yet, but this sideline war is amusing to see.
What else should the richest man on the planet be doing about global warming? Really? Dude literally had full access to the US government and…? Like… he could tweet on it to start?
The best-selling car in the world all-time is the Toyota Corolla. The Tesla Model Y was the best-selling car in a single year, 2023. Every other year since 2020, the best-selling car was a Toyota.
I didn't expect the difference to be quite so large, but apparently, Tesla has sold about 9.72 million cars since 2008; in the same time span, Toyota has sold about 183 million.
This guy has actively sabotaged rail systems in multiple cities, how much of a negative impact has that had?
Let's just stop claiming he actually cares about the environment and that he just wants wealth and power and he saw a business opportunity taking over Tesla.
So you don't remember his Hyperloop "invention" media circus targeted at California high speed rail? What about DOGE targeting the same? What about the Boring company pitching his dumb car tubes?
He's a car salesman doing what a billionaire car salesman does.
I wanted to say it could be argued his support for pro fossil fuel political candidate is hugely detrimental to the cause but then the war hiked oil price so much that this morning I saw a stat that shows global CO2 emission started to fall…
He did sell them, though how much this matters is more like "were CO2 permit trading prices set correctly?" rather than something to blame Musk for.
For me personally, things like this make me question the value of the businesses rather than the environment. Like, I'm not sure if it's true this year, but in several recent years you could correctly say Musk personally made more money selling Tesla shares than Tesla made lifetime net profit, and likewise could correctly say that if all government subsidies and artificial markets were removed Tesla would not have made a profit at all.
Carbon trading is the "free market" solution to getting businesses to price-in what would otherwise be a free externality.
I won't praise Musk for it (at best praise goes to the governments setting up the rules), so we're probably on the same page, but it did feel like you were painting him as a villain for taking part in something that at least solves one of the common criticisms of carbon emitting industries.
Not exactly, the "free market" solution would be a carbon tax. The distinction matters here - had Musk not sold Teslas offsets, those other businesses would have paid a higher (and more accurate) price.
It may feel like that because it takes away Musks "at least he built the Autobahn" (even though the statement is of course also inaccurate for the original). But I consider it very dishonest to assign CO2 savings from electric cars to him, without also mentioning him profiting off of those emissions in other places.
... as allowed and intended by our government, and using the proceeds to build the factories that allowed them to scale production to the point where the best-selling car in the world can be electric, which otherwise would have taken longer. Having served their purpose, these emissions credits are now going away.
They will be, as the faster scaling of electric car production means more emissions will be saved going forward, and there won't be any more emissions credits offsetting them. And Tesla sold cars in places without emissions credits too. I'm sure there were more than enough of those to offset the rockets with plenty left over.
But Tesla is one of America's roadblocks to scaling EV usage. They cancelled their $25,000 EV plans after the US blocked economic competitors like BYD from entering the US market. The ostensible goal of Tesla is not to reduce emissions through democratized EVs, but to protect their bottom-line and forcibly prevent competition from undermining their profits.
It's not Elon's fault the US put 100% tariffs on Chinese EVs. It's not even Trump's fault. Biden did it! You can't pin that on Elon.
Tesla isn't afraid of Chinese competition. They compete directly with BYD in China and win. Model Y outsells any BYD model. All other US automakers, on the other hand, are terrified. And for good reason.
Meanwhile, Tesla is still making a $25,000 EV. It's just not designed for personal ownership. Tesla is betting on autonomous fleets as the future of cars. But they're still electric. Shared fleets would be way more efficient than personal car ownership, so this is even better for the climate, actually.
And they're doing Semi and Megapack and Superchargers (open to all EVs) too. They're doing their own battery R&D at their own battery factory, their own lithium refining, their own solar cell production. Honestly ridiculous that you would try to paint Tesla as some kind of climate traitor.
BYD sells several times more different EV models in twice as many countries, yet it only totals 38% more EV units than Tesla (2025). What puts them in the top 10 is their non-EV sales, which Tesla doesn't do at all.
Cybertruck is a flop, no argument there.
The reason Tesla hasn't scaled further is that a few years ago they pivoted in strategy and are no longer heavily pursuing the consumer market with new models for personal ownership. For better or worse they are all in on autonomous fleet vehicles and Optimus. The pivot was probably a few years too early. Many think it'll never work and I'm sure you're among them, but time will tell.
Not aggressively pursuing future new consumer models is not the same thing as being a low volume manufacturer. Autonomous fleet vehicles are also not going to be low volume, either.
Model Y continues to have the highest production volume of any model in the world, and you want to call that low volume manufacturing? I'm done engaging here, have fun.
He is the man with a plan a certain ideology wants to see eradicated. His existence is a intro to what western society has missed out on while coasting on past success build by people like him. If you dislike him why not leave the west?
> Actually if you tank them with sustainable fuel..
Getting Starship to be useful for Mars missions requires actually building industrial-scale Sabatier machines.
This is something he has known about, and talked about, for a long time; it's (apparently) why they're designed around methane.
However, we don't see any reports of work on such machines.
This is both bad for the environment here on Earth, and also an indicator that despite what he's been saying, Mars has been less of an interest for several years before he officially put the moon and space data centres ahead of it.
But we were already supposed to be colonizing mars a few years ago right? And we're supposed to have fleets of autonomous robotaxis that can drive across the country by themselves; where do they have those? And the hyperloop? Tunnels in LA? I could go on...
Starmind may indeed be entirely a cynical ploy to get investors banging on his doors. I think this is the only sensible reason for it, even. I really need to make time to finish that blog post…
However, merely switching from Mars to the Moon isn't by itself a reason for the complete absence of any public presentations about progress with industrial-scale Sabatier machines.
There's a lot of good use for industrial-scale Sabatier machines right now, on Earth. Use renewables to synthesise methane, the main component of natural gas: (1) Hormuz less important; (2) those gas turbines powering his ground based data centres look a lot less bad (still bad, but less bad); (3) methane-fuelled rockets look a lot greener; (4) can sell to any nation with a lot of renewable supply that wants to get into petrochemicals (though I suppose "petro" is a misnomer if it's not from rocks…)
Like, it wouldn't be entirely nuts to say this is order-of a trillion dollar opportunity, if someone got it right. At least, assuming the same playbook as the SpaceX IPO for TAMs, which I absolutely do consider to look suspiciously like they gamed a metric that allows such gaming.
Colonizing the moon first is not a bad idea and ultimately we do need to find some way of (in the far future) mitigating the sun's expansion, whether it's moving to another planet or something
Mars is just really far. You can send lots of robots. Human beings is a tougher thing
"Mitigating the sun's expansion" is right up there with "bringing the unicorns back", in both plausibility and need. At least for the existence timeline of genus Homo.
Fair point, that happens when i'm trying to be on MS Teams for a conf call, while watching my claude code terminal and then browsing HN on another monitor :-/
Maybe one problem is the time between prompts, much like going to get a coffee when you start a big build, now it's filling time between prompts (plus the build), which can be any number of distracting rabbit holes (the internet is a big place) the split context feels exhausting to me.
LEB128 can only trick you by at most one byte, (depending on the followup data). Bijou64 can consistently trick you by 8 bytes.
In a contrived example of a pbuf {length:int, payload:byte[1]}
LEB128 can trick you into reading the payload as part of the length, but then hopefully trigger a code check against invalid buffer read. (or one byte outside the struct if the payload is also malicious)
Binou64 can trick you to read 7 bytes into other memory, before any buffer size validation is done.
It's then not uncommon to log with a helpful; "buffer with length: 26624894573377(7 bytes of stolen data) is invalid", or just crash.
It's to the point that Bijou64_decode should perhaps take "end_adress" or "max_read" to catch this kind of attack.
(If you dont validate a malicious pbuf, you're in for a bad time regardless of integer format, but these int formats add their own way to trigger a buffer overrun despite a proper check.)
reply