Paint RCE in Windows 11: Patch Shipped, Nobody Got It
Microsoft fixed a zero-click Paint RCE in Windows 11, yet Microsoft Store still ships the vulnerable build. A stalled patch pipeline is a gift to botnets.
Zero-click vulnerabilities execute without any user interaction — a crafted network packet, message or file is enough to trigger code execution. They are prized by botnet operators because mass exploitation needs no phishing lure and no user mistake.
Microsoft fixed a zero-click Paint RCE in Windows 11, yet Microsoft Store still ships the vulnerable build. A stalled patch pipeline is a gift to botnets.