CVE-2025-59050
Greenshot — Insecure .NET deserialization via WM_COPYDATA enables local code execution
Description
Greenshot is an open source Windows screenshot utility. Greenshot 1.3.300 and earlier deserializes attacker-controlled data received in a WM_COPYDATA message using BinaryFormatter.Deserialize without prior validation or authentication, allowing a local process at the same integrity level to trigger arbitrary code execution inside the Greenshot process. The vulnerable logic resides in a WinForms WndProc handler for WM_COPYDATA (message 74) that copies the supplied bytes into a MemoryStream and invokes BinaryFormatter.Deserialize, and only afterward checks whether the specified channel is authorized. Because the authorization check occurs after deserialization, any gadget chain embedded in the serialized payload executes regardless of channel membership. A local attacker who can send WM_COPYDATA to the Greenshot main window can achieve in-process code execution, which may aid evasion of application control policies by running payloads within the trusted, signed Greenshot.exe process. This issue is fixed in version 1.3.301. No known workarounds exist.
INFO
Published Date :
Sept. 16, 2025, 5:15 p.m.
Last Modified :
Oct. 19, 2026, 5:10 p.m.
Remotely Exploit :
No
Source :
[email protected]
Affected Products
The following products are affected by CVE-2025-59050
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 3.1 | HIGH | [email protected] |
Solution
- Update Greenshot to version 1.3.301.
- Avoid processing untrusted data with BinaryFormatter.
- Implement deserialization input validation.
- Ensure proper authorization checks.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-59050.
| URL | Resource |
|---|---|
| https://github.com/greenshot/greenshot/commit/f5a29a2ed3b0eb49231c0f4618300f488cf1b04d | Patch |
| https://github.com/greenshot/greenshot/security/advisories/GHSA-8f7f-x7ww-xx5w | Exploit Vendor Advisory |
| https://github.com/greenshot/greenshot/security/advisories/GHSA-8f7f-x7ww-xx5w | Exploit Vendor Advisory |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-59050 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-59050
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-59050 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2025-59050 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 19, 2026
Action Type Old Value New Value Added Translation Title: Greenshot, Description: Greenshot es una utilidad de captura de pantalla de código abierto para Windows. Greenshot 1.3.300 y versiones anteriores deserializa datos controlados por el atacante recibidos en un mensaje WM_COPYDATA usando BinaryFormatter.Deserialize sin validación o autenticación previa, permitiendo que un proceso local con el mismo nivel de integridad desencadene la ejecución de código arbitrario dentro del proceso de Greenshot. La lógica vulnerable reside en un gestor WndProc de WinForms para WM_COPYDATA (mensaje 74) que copia los bytes suministrados en un MemoryStream e invoca BinaryFormatter.Deserialize, y solo después verifica si el canal especificado está autorizado. Debido a que la verificación de autorización ocurre después de la deserialización, cualquier cadena de gadgets incrustada en la carga útil serializada se ejecuta independientemente de la membresía del canal. Un atacante local que puede enviar WM_COPYDATA a la ventana principal de Greenshot puede lograr la ejecución de código en proceso, lo que puede ayudar a la evasión de las políticas de control de aplicaciones al ejecutar cargas útiles dentro del proceso confiable y firmado Greenshot.exe. Este problema está solucionado en la versión 1.3.301. No existen soluciones alternativas conocidas. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'greenshot', 'product': 'greenshot', 'versions': [{'status': 'affected', 'version': '< 1.3.301'}]}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2025-59050', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2025-09-16T17:29:53.576216Z'} -
Initial Analysis by [email protected]
Oct. 02, 2025
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Added CPE Configuration OR *cpe:2.3:a:getgreenshot:greenshot:*:*:*:*:*:*:*:* versions up to (excluding) 1.3.301 Added Reference Type GitHub, Inc.: https://github.com/greenshot/greenshot/commit/f5a29a2ed3b0eb49231c0f4618300f488cf1b04d Types: Patch Added Reference Type CISA-ADP: https://github.com/greenshot/greenshot/security/advisories/GHSA-8f7f-x7ww-xx5w Types: Exploit, Vendor Advisory Added Reference Type GitHub, Inc.: https://github.com/greenshot/greenshot/security/advisories/GHSA-8f7f-x7ww-xx5w Types: Exploit, Vendor Advisory -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Sep. 16, 2025
Action Type Old Value New Value Added Reference https://github.com/greenshot/greenshot/security/advisories/GHSA-8f7f-x7ww-xx5w -
New CVE Received by [email protected]
Sep. 16, 2025
Action Type Old Value New Value Added Description Greenshot is an open source Windows screenshot utility. Greenshot 1.3.300 and earlier deserializes attacker-controlled data received in a WM_COPYDATA message using BinaryFormatter.Deserialize without prior validation or authentication, allowing a local process at the same integrity level to trigger arbitrary code execution inside the Greenshot process. The vulnerable logic resides in a WinForms WndProc handler for WM_COPYDATA (message 74) that copies the supplied bytes into a MemoryStream and invokes BinaryFormatter.Deserialize, and only afterward checks whether the specified channel is authorized. Because the authorization check occurs after deserialization, any gadget chain embedded in the serialized payload executes regardless of channel membership. A local attacker who can send WM_COPYDATA to the Greenshot main window can achieve in-process code execution, which may aid evasion of application control policies by running payloads within the trusted, signed Greenshot.exe process. This issue is fixed in version 1.3.301. No known workarounds exist. Added CVSS V3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-502 Added Reference https://github.com/greenshot/greenshot/commit/f5a29a2ed3b0eb49231c0f4618300f488cf1b04d Added Reference https://github.com/greenshot/greenshot/security/advisories/GHSA-8f7f-x7ww-xx5w