PT-2026-26600 · Greenshot+1 · Greenshot+1

Mariorl0 · Published 2026-03-20 · Updated 2026-03-22 · CVE-2026-25792

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Greenshot versions 1.3.312 and below

Description Greenshot is a Windows screenshot utility. Versions 1.3.312 and below contain an untrusted executable search path/binary hijacking issue. A local attacker can execute arbitrary code when the application launches explorer.exe without using an absolute path. The issue is triggered when a user double-clicks the application’s tray icon, opening the directory containing the most recent screenshot. An attacker can place a malicious executable with the same name in a location searched before the legitimate Windows binary, gaining code execution in the application’s context.

Recommendations Versions prior to 1.3.312 should be updated. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

CVE-2026-25792

GHSA-F8V9-7FPH-FR2J

Affected Products

Greenshot

Windows

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25792.json · Exploit
• https://github.com/greenshot/greenshot/security/advisories/GHSA-f8v9-7fph-fr2j · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25792 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25792 · Security Note
• https://twitter.com/CVEnew/status/2035626989218906587 · Twitter Post