Arbitrary Code Execution in Greenshot Screenshot Utility

CVE-2025-59050

What is CVE-2025-59050?

Greenshot, an open-source Windows screenshot tool, is vulnerable to arbitrary code execution due to unsafe deserialization of attacker-controlled data in the WM_COPYDATA message. Specifically, versions 1.3.300 and earlier utilize BinaryFormatter.Deserialize without adequate validation or authentication, allowing local processes to exploit this flaw. The vulnerability exists in the handling of WM_COPYDATA messages in a WinForms WndProc, where an authorization check is improperly sequenced. Consequently, unauthorized payloads can execute within the trusted Greenshot process, potentially bypassing application control measures. Users are urged to upgrade to version 1.3.301 or later, as no workarounds can effectively mitigate the risk.

References