CVE-2025-59050

{
  "id": "CVE-2025-59050",
  "sourceIdentifier": "[email protected]",
  "published": "2025-09-16T17:15:41.433",
  "lastModified": "2026-10-19T17:10:00.173",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Greenshot is an open source Windows screenshot utility. Greenshot 1.3.300 and earlier deserializes attacker-controlled data received in a WM_COPYDATA message using BinaryFormatter.Deserialize without prior validation or authentication, allowing a local process at the same integrity level to trigger arbitrary code execution inside the Greenshot process. The vulnerable logic resides in a WinForms WndProc handler for WM_COPYDATA (message 74) that copies the supplied bytes into a MemoryStream and invokes BinaryFormatter.Deserialize, and only afterward checks whether the specified channel is authorized. Because the authorization check occurs after deserialization, any gadget chain embedded in the serialized payload executes regardless of channel membership. A local attacker who can send WM_COPYDATA to the Greenshot main window can achieve in-process code execution, which may aid evasion of application control policies by running payloads within the trusted, signed Greenshot.exe process. This issue is fixed in version 1.3.301. No known workarounds exist."
    },
    {
      "lang": "es",
      "value": "Greenshot es una utilidad de captura de pantalla de código abierto para Windows. Greenshot 1.3.300 y versiones anteriores deserializa datos controlados por el atacante recibidos en un mensaje WM_COPYDATA usando BinaryFormatter.Deserialize sin validación o autenticación previa, permitiendo que un proceso local con el mismo nivel de integridad desencadene la ejecución de código arbitrario dentro del proceso de Greenshot. La lógica vulnerable reside en un gestor WndProc de WinForms para WM_COPYDATA (mensaje 74) que copia los bytes suministrados en un MemoryStream e invoca BinaryFormatter.Deserialize, y solo después verifica si el canal especificado está autorizado. Debido a que la verificación de autorización ocurre después de la deserialización, cualquier cadena de gadgets incrustada en la carga útil serializada se ejecuta independientemente de la membresía del canal. Un atacante local que puede enviar WM_COPYDATA a la ventana principal de Greenshot puede lograr la ejecución de código en proceso, lo que puede ayudar a la evasión de las políticas de control de aplicaciones al ejecutar cargas útiles dentro del proceso confiable y firmado Greenshot.exe. Este problema está solucionado en la versión 1.3.301. No existen soluciones alternativas conocidas."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "greenshot",
          "product": "greenshot",
          "versions": [
            {
              "version": "< 1.3.301",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.4,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 5.9
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-09-16T17:29:53.576216Z",
          "id": "CVE-2025-59050",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:getgreenshot:greenshot:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "1.3.301",
              "matchCriteriaId": "686A0D0C-A956-46F9-A83D-AA19786DECAA"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/greenshot/greenshot/commit/f5a29a2ed3b0eb49231c0f4618300f488cf1b04d",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/greenshot/greenshot/security/advisories/GHSA-8f7f-x7ww-xx5w",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/greenshot/greenshot/security/advisories/GHSA-8f7f-x7ww-xx5w",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    }
  ]
}