CVE-2025-63916

{
  "id": "CVE-2025-63916",
  "sourceIdentifier": "[email protected]",
  "published": "2025-11-17T16:15:50.700",
  "lastModified": "2026-11-05T14:10:00.273",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "MyScreenTools v2.2.1.0 contains a critical OS command injection vulnerability in the GIF compression tool. The application fails to properly sanitize user-supplied file paths before passing them to cmd.exe, allowing attackers to execute arbitrary system commands with the privileges of the user running the application. The vulnerability exists in the CMD() function within GIFSicleTool\\Form_gif_sicle_tool.cs, which constructs shell commands by concatenating unsanitized user input (file paths) and executes them via cmd.exe."
    },
    {
      "lang": "es",
      "value": "MyScreenTools v2.2.1.0 contiene una vulnerabilidad crítica de inyección de comandos del sistema operativo en la herramienta de compresión de GIF. La aplicación no logra sanear correctamente las rutas de archivo proporcionadas por el usuario antes de pasarlas a cmd.exe, permitiendo a los atacantes ejecutar comandos de sistema arbitrarios con los privilegios del usuario que ejecuta la aplicación. La vulnerabilidad existe en la función CMD() dentro de GIFSicleTool\\Form_gif_sicle_tool.cs, que construye comandos de shell concatenando entradas de usuario no saneadas (rutas de archivo) y los ejecuta a través de cmd.exe."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-11-17T18:59:40.637713Z",
          "id": "CVE-2025-63916",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:luotengyuan:myscreentools:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "2.2.1.0",
              "matchCriteriaId": "3C10E4CB-8181-4933-B9A6-7911F777EB06"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/cydtseng/Vulnerability-Research/blob/main/myscreentools/OSCommandInjection-GifCompression.md",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Mitigation",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://github.com/luotengyuan/MyScreenTools/blob/master/GIFSicleTool/Form_gif_sicle_tool.cs",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    },
    {
      "url": "https://github.com/luotengyuan/MyScreenTools/tree/master",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    }
  ]
}