CVE-2021-31946: Paint 3D for Windows 10 Remote Code Execution Vulnerability

Paint 3D is one of the programs pre-installed by Microsoft in the Windows 10 system. The program mainly provides more feature-rich picture editing.

Of course, the usage rate of this program is so low that Microsoft has to give it up. Now Microsoft has confirmed that this program may also threaten your system security.

According to an announcement issued by the Microsoft Security Response Center, Paint 3D was found to have a remote code execution vulnerability (CVE-2021-31946) during the fuzzing test.

Therefore, for users, even if they do not use this program, they must perform the update. Of course, they can also be uninstalled directly to save trouble. Windows 11 no longer pre-installs this program.

The issue is described in CVE-2021-31946 and reads as follows:

Remote Code Execution Vulnerability When Scanning Microsoft Paint 3D GLB Files Read Out of Range

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Paint 3D. User interaction is required to exploit this vulnerability as the target must visit a malicious page or open a malicious file.

The specific flaw exists in the analysis of GLB files. The problem stems from the lack of proper validation of user-supplied data, which can cause a read past the end of an allocated data structure. An attacker can exploit this vulnerability to execute code in the context of the running process with low integrity.

According to the security bulletin, Microsoft discovered this vulnerability during the fuzzing test. The cause of the vulnerability was that the drawing program did not perform correct verification when parsing files.

Hackers can use this vulnerability when they create a specific GLB file. If they want to exploit this vulnerability, hackers also need to induce users to download and open the malicious file with Pait 3D program.

When the user opens such a specially crafted file, the attacker can use the vulnerability to execute code on the current process, but the rating of this vulnerability is not high risk but medium risk.

Of course, considering that not many people use this drawing program, it may not be easy to use it, and Microsoft has also released an update to solve the vulnerability.