Microsoft's worst Windows 10 tool has a mega security flaw

Paint 3D on a Surface
(Image credit: Microsoft)
Audio player loading…

Security researchers from Trend Micro's Zero Day Initiative (ZDI (opens in new tab)) have discovered a new vulnerability in one of the least popular tools that comes pre-installed with Windows 10 (opens in new tab).

First introduced as part of the Microsoft's Creators Update back in 2016, Paint 3D (opens in new tab) was originally intended to be a replacement for Microsoft Paint (opens in new tab) that has shipped with the company's operating system since Windows 1.0. 

However, the 3D modeling software (opens in new tab) never saw the kind of adoption the software giant hoped for which is why Paint and Paint 3D continue to live alongside each other on Windows. This could change soon though as Paint 3D was not included in a recently leaked build of Windows 11 (opens in new tab).

While difficult to exploit, the recently discovered flaw, which has now been patched by Microsoft, could be another reason why Paint 3D's days may be numbered.

Remote code execution in Paint 3D

The vulnerability in Paint 3D, tracked as CVE-2021-31946 (opens in new tab), could be exploited by an attacker to execute arbitrary code after an unsuspecting users visits a malicious page or opens a malicious file according to a new security advisory (opens in new tab) from ZDI.

However, in order to exploit this vulnerability, an attacker would first need to achieve privilege escalation on a targeted system before persuading a user to open a malicious file or website.

ZDI discovered this vulnerability using a technique called fuzzing (opens in new tab) earlier this year and it then reported its findings to Microsoft back in February. Thankfully the security researchers have not observed an exploits in the wild or publicly available proof-of-concept code which means that Windows users should be safe for now.

At the same time, Microsoft has also issued a patch to address the vulnerability that is now rolling out to users' systems via the Microsoft Store (opens in new tab). If you don't have automatic updates set up in the Microsoft Store, you can also manually download the update by following these instructions (opens in new tab).

We'll have to wait and see if Paint 3D makes the cut in the next version of Microsoft's operating system though the company has an event (opens in new tab) planned for later this month that will shed more light on Windows 11.

Via The Register (opens in new tab)

After working with the TechRadar Pro team for the last several years, Anthony is now the security and networking editor at Tom’s Guide where he covers everything from data breaches and ransomware gangs to the best way to cover your whole home or business with Wi-Fi. When not writing, you can find him tinkering with PCs and game consoles, managing cables and upgrading his smart home.