CVE-2025-59050
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
Greenshot 1.3.300 and earlier deserializes attacker-controlled data received in a WM_COPYDATA message using BinaryFormatter.Deserialize without prior validation or authentication, allowing a local process at the same integrity level to trigger arbitrary code execution inside the Greenshot process. The authorization check for the channel occurs only after deserialization, so any gadget chain in the serialized payload executes regardless of channel membership. This is fixed in version 1.3.301.
Risk Assessment
A local attacker can execute arbitrary code within the trusted, signed Greenshot.exe process, which may aid evasion of application control policies. Exploitation requires the ability to send WM_COPYDATA to the Greenshot main window.
Recommendation
Update Greenshot to version 1.3.301 or later. No known workarounds exist, so updating is the only effective remediation.
Other vulnerabilities in Greenshot
See all- CVE-2026-22035High
Greenshot versions 1.3.310 and below are vulnerable to OS Command Injection through unsanitized filename processing. The FormatArguments method in ExternalCommandDestination.cs:269 uses string.Format() to insert user-controlled filenames directly into shell commands without sanitization, allowing attackers to execute arbitrary commands by crafting malicious filenames containing shell metacharacters. This issue is fixed in version 1.3.311.
- CVE-2023-34634High
Greenshot version 1.2.10 and below allows arbitrary code execution due to insecure deserialization of .NET content when a .greenshot file is opened.
Original NVD description (English source)
Greenshot is an open source Windows screenshot utility. Greenshot 1.3.300 and earlier deserializes attacker-controlled data received in a WM_COPYDATA message using BinaryFormatter.Deserialize without prior validation or authentication, allowing a local process at the same integrity level to trigger arbitrary code execution inside the Greenshot process. The vulnerable logic resides in a WinForms WndProc handler for WM_COPYDATA (message 74) that copies the supplied bytes into a MemoryStream and invokes BinaryFormatter.Deserialize, and only afterward checks whether the specified channel is authorized. Because the authorization check occurs after deserialization, any gadget chain embedded in the serialized payload executes regardless of channel membership. A local attacker who can send WM_COPYDATA to the Greenshot main window can achieve in-process code execution, which may aid evasion of application control policies by running payloads within the trusted, signed Greenshot.exe process. This issue is fixed in version 1.3.301. No known workarounds exist.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS