CVE-2023-34634
HighCVSS 7.8Exploitation Probability (EPSS)
Very high risk94th percentile - higher than 94% of all known CVEs
Summary
Greenshot version 1.2.10 and below allows arbitrary code execution due to insecure deserialization of .NET content when a .greenshot file is opened.
Risk Assessment
Exploitation of this vulnerability could lead to remote code execution, posing a serious security threat to the organization's systems.
Recommendation
It is recommended to update Greenshot to the latest version to mitigate the risk associated with this vulnerability.
Other vulnerabilities in Greenshot
See all- CVE-2026-22035High
Greenshot versions 1.3.310 and below are vulnerable to OS Command Injection through unsanitized filename processing. The FormatArguments method in ExternalCommandDestination.cs:269 uses string.Format() to insert user-controlled filenames directly into shell commands without sanitization, allowing attackers to execute arbitrary commands by crafting malicious filenames containing shell metacharacters. This issue is fixed in version 1.3.311.
- CVE-2025-59050High
Greenshot 1.3.300 and earlier deserializes attacker-controlled data received in a WM_COPYDATA message using BinaryFormatter.Deserialize without prior validation or authentication, allowing a local process at the same integrity level to trigger arbitrary code execution inside the Greenshot process. The authorization check for the channel occurs only after deserialization, so any gadget chain in the serialized payload executes regardless of channel membership. This is fixed in version 1.3.301.
Original NVD description (English source)
Greenshot 1.2.10 and below allows arbitrary code execution because .NET content is insecurely deserialized when a .greenshot file is opened.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS