PT-2025-47159 · Unknown · Myscreentools

Published 2025-11-17 · Updated 2025-11-17 · CVE-2025-63916

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions MyScreenTools version 2.2.1.0

Description The software contains a critical OS command injection issue in the GIF compression tool. The application does not properly sanitize user-supplied file paths before passing them to cmd.exe, which allows attackers to execute arbitrary system commands with the privileges of the user running the application. The vulnerability is located in the CMD() function within the GIFSicleToolForm gif sicle tool.cs file, where shell commands are constructed by concatenating unsanitized user input (file paths) and executed via cmd.exe.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the GIF compression tool until a patch is available.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-63916

Affected Products

Myscreentools

References · 8

• 🔥 https://github.com/cydtseng/Vulnerability-Research/blob/main/myscreentools/OSCommandInjection-GifCompression.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-63916 · Security Note
• https://osv.dev/vulnerability/CVE-2025-63916 · Vendor Advisory
• https://github.com/luotengyuan/MyScreenTools/blob/master/GIFSicleTool/Form_gif_sicle_tool.cs · Note
• https://github.com/luotengyuan/MyScreenTools/tree/master · Note
• https://twitter.com/VulmonFeeds/status/1990569871432618123 · Twitter Post
• https://t.me/CVEtracker/37502 · Telegram Post
• https://twitter.com/CVEnew/status/1990462692033720750 · Twitter Post