PT-2025-38057 · Greenshot · Greenshot

Ripfran

·

Published

2025-09-16

·

Updated

2025-09-20

·

CVE-2025-59050

CVSS v3.1

8.4

High

VectorAV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Greenshot versions prior to 1.3.301
Description Greenshot is a Windows screenshot utility. Versions prior to 1.3.301 deserialize attacker-controlled data received in a WM COPYDATA message using BinaryFormatter.Deserialize without prior validation or authentication. This allows a local process at the same integrity level to trigger arbitrary code execution inside the Greenshot process. The vulnerable logic is located in a WinForms WndProc handler for the WM COPYDATA message (message 74), which copies supplied bytes into a MemoryStream and invokes BinaryFormatter.Deserialize, with authorization checks occurring after deserialization. This allows any gadget chain embedded in the serialized payload to execute regardless of channel membership. A local attacker who can send a WM COPYDATA message to the Greenshot main window can achieve in-process code execution.
Recommendations Update to Greenshot version 1.3.301 or later.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-59050
GHSA-8F7F-X7WW-XX5W

Affected Products

Greenshot